diff --git a/.gitattributes b/.gitattributes
index 5e6fc3ef52..e11419ebbf 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,4 @@
 * text=auto
 *.bicep text eol=lf
+*.ps1 text eol=lf
+*.sh text eol=lf
\ No newline at end of file
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index f2e95ff076..31e04d58e8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,6 +3,7 @@
 /scripts/ @Azure/bicep-admins @Azure/avm-core-team-technical-bicep
 /avm/ @Azure/avm-core-team-technical-bicep
 /avm/utilities/ @Azure/avm-core-team-technical-bicep
+/avm/ptn/aca-lza/hosting-environment/ @Azure/avm-ptn-acalza-hostingenvironment-module-owners-bicep @Azure/avm-module-reviewers-bicep
 /avm/ptn/ai-platform/baseline/ @Azure/avm-ptn-aiplatform-baseline-module-owners-bicep @Azure/avm-module-reviewers-bicep
 /avm/ptn/authorization/policy-assignment/ @Azure/avm-ptn-authorization-policyassignment-module-owners-bicep @Azure/avm-module-reviewers-bicep
 /avm/ptn/authorization/resource-role-assignment/ @Azure/avm-ptn-authorization-resourceroleassignment-module-owners-bicep @Azure/avm-module-reviewers-bicep
@@ -11,6 +12,7 @@
 #/avm/ptn/avd-lza/management-plane/ @Azure/avm-ptn-avd-lza-managementplane-module-owners-bicep @Azure/avm-module-reviewers-bicep
 #/avm/ptn/avd-lza/networking/ @Azure/avm-ptn-avd-lza-networking-module-owners-bicep @Azure/avm-module-reviewers-bicep
 #/avm/ptn/avd-lza/session-hosts/ @Azure/avm-ptn-avd-lza-sessionhosts-module-owners-bicep @Azure/avm-module-reviewers-bicep
+/avm/ptn/azd/container-apps/ @Azure/avm-ptn-azd-containerapps-module-owners-bicep @Azure/avm-module-reviewers-bicep
 /avm/ptn/deployment-script/import-image-to-acr/ @Azure/avm-ptn-deploymentscript-importimagetoacr-module-owners-bicep @Azure/avm-module-reviewers-bicep
 /avm/ptn/finops-toolkit/finops-hub/ @Azure/avm-ptn-finopstoolkit-finopshub-module-owners-bicep @Azure/avm-module-reviewers-bicep
 /avm/ptn/lz/sub-vending/ @Azure/avm-ptn-lz-subvending-module-owners-bicep @Azure/avm-module-reviewers-bicep
diff --git a/.github/ISSUE_TEMPLATE/avm_module_issue.yml b/.github/ISSUE_TEMPLATE/avm_module_issue.yml
index 8bfe4860a5..ef63ce6e6e 100644
--- a/.github/ISSUE_TEMPLATE/avm_module_issue.yml
+++ b/.github/ISSUE_TEMPLATE/avm_module_issue.yml
@@ -38,6 +38,7 @@ body:
       description: Which existing AVM module is this issue related to?
       options:
         - ""
+        - "avm/ptn/aca-lza/hosting-environment"
         - "avm/ptn/ai-platform/baseline"
         - "avm/ptn/authorization/policy-assignment"
         - "avm/ptn/authorization/resource-role-assignment"
@@ -46,6 +47,7 @@ body:
         # - "avm/ptn/avd-lza/management-plane"
         # - "avm/ptn/avd-lza/networking"
         # - "avm/ptn/avd-lza/session-hosts"
+        - "avm/ptn/azd/container-apps"
         - "avm/ptn/deployment-script/import-image-to-acr"
         - "avm/ptn/finops-toolkit/finops-hub"
         - "avm/ptn/lz/sub-vending"
diff --git a/.github/actions/templates/avm-validateModuleDeployment/action.yml b/.github/actions/templates/avm-validateModuleDeployment/action.yml
index f73968f350..715a2f642b 100644
--- a/.github/actions/templates/avm-validateModuleDeployment/action.yml
+++ b/.github/actions/templates/avm-validateModuleDeployment/action.yml
@@ -208,6 +208,7 @@ runs:
             AdditionalParameters       = @{}
           }
 
+          # Add custom parameters as needed
           if($moduleTemplatePossibleParameters -contains 'resourceLocation') {
             $functionInput.AdditionalParameters += @{
               resourceLocation = '${{ steps.get-resource-location.outputs.resourceLocation }}'
@@ -219,6 +220,24 @@ runs:
             }
           }
 
+          # Fetch & add custom secrets, if any
+          # -----------------------------------
+          $keyVaultName = "${{ env.CI_KEY_VAULT_NAME }}"
+          if(-not [String]::IsNullOrEmpty($keyVaultName)) {
+            # Note: This action requires at least 'Key Vault Secrets User' permissions
+            $customKeyVaultSecrets = Get-AzKeyVaultSecret -VaultName $keyVaultName | Where-Object { $_.Name -match '^CI-.+' }
+
+            foreach($customSecret in $customKeyVaultSecrets) {
+              $formattedName = $customSecret.Name -replace '^CI-' # e.g. 'CI-mySecret' -> 'mySecret'
+              if($moduleTemplatePossibleParameters -contains $formattedName) {
+                Write-Verbose ('Setting value for parameter [{0}]' -f $formattedName) -Verbose
+                $functionInput.AdditionalParameters += @{
+                  $formattedName = (Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $customSecret.Name).SecretValue
+                }
+              }
+            }
+          }
+
           Write-Verbose 'Invoke task with' -Verbose
           Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
 
@@ -280,6 +299,24 @@ runs:
             }
           }
 
+          # Fetch & add custom secrets, if any
+          # -----------------------------------
+          $keyVaultName = "${{ env.CI_KEY_VAULT_NAME }}"
+          if(-not [String]::IsNullOrEmpty($keyVaultName)) {
+            # Note: This action requires at least 'Key Vault Secrets User' permissions
+            $customKeyVaultSecrets = Get-AzKeyVaultSecret -VaultName $keyVaultName | Where-Object { $_.Name -match '^CI-.+' }
+
+            foreach($customSecret in $customKeyVaultSecrets) {
+              $formattedName = $customSecret.Name -replace '^CI-' # e.g. 'CI-mySecret' -> 'mySecret'
+              if($moduleTemplatePossibleParameters -contains $formattedName) {
+                Write-Verbose ('Setting value for parameter [{0}]' -f $formattedName) -Verbose
+                $functionInput.AdditionalParameters += @{
+                  $formattedName = (Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $customSecret.Name).SecretValue
+                }
+              }
+            }
+          }
+
           Write-Verbose 'Invoke task with' -Verbose
           Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
 
diff --git a/.github/workflows/avm.ptn.aca-lza.hosting-environment.yml b/.github/workflows/avm.ptn.aca-lza.hosting-environment.yml
new file mode 100644
index 0000000000..d7f47a87e5
--- /dev/null
+++ b/.github/workflows/avm.ptn.aca-lza.hosting-environment.yml
@@ -0,0 +1,90 @@
+name: "avm.ptn.aca-lza.hosting-environment"
+
+on:
+  workflow_dispatch:
+    inputs:
+      staticValidation:
+        type: boolean
+        description: "Execute static validation"
+        required: false
+        default: true
+      deploymentValidation:
+        type: boolean
+        description: "Execute deployment validation"
+        required: false
+        default: true
+      removeDeployment:
+        type: boolean
+        description: "Remove deployed module"
+        required: false
+        default: true
+      customLocation:
+        type: string
+        description: "Default location overwrite (e.g., eastus)"
+        required: false
+        default: 'northeurope'
+  push:
+    branches:
+      - main
+      - avm-ptn-acalza-hostingenvironment
+    paths:
+      - ".github/actions/templates/avm-**"
+      - ".github/workflows/avm.template.module.yml"
+      - ".github/workflows/avm.ptn.aca-lza.hosting-environment.yml"
+      - "avm/ptn/aca-lza/hosting-environment/**"
+      - "avm/utilities/pipelines/**"
+      - "!avm/utilities/pipelines/platform/**"
+      - "!*/**/README.md"
+
+env:
+  modulePath: "avm/ptn/aca-lza/hosting-environment"
+  workflowPath: ".github/workflows/avm.ptn.aca-lza.hosting-environment.yml"
+
+concurrency:
+  group: ${{ github.workflow }}
+
+jobs:
+  ###########################
+  #   Initialize pipeline   #
+  ###########################
+  job_initialize_pipeline:
+    runs-on: ubuntu-latest
+    name: "Initialize pipeline"
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: "Set input parameters to output variables"
+        id: get-workflow-param
+        uses: ./.github/actions/templates/avm-getWorkflowInput
+        with:
+          workflowPath: "${{ env.workflowPath}}"
+      - name: "Get module test file paths"
+        id: get-module-test-file-paths
+        uses: ./.github/actions/templates/avm-getModuleTestFiles
+        with:
+          modulePath: "${{ env.modulePath }}"
+    outputs:
+      workflowInput: ${{ steps.get-workflow-param.outputs.workflowInput }}
+      moduleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.moduleTestFilePaths }}
+      psRuleModuleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.psRuleModuleTestFilePaths }}
+      modulePath: "${{ env.modulePath }}"
+
+  ##############################
+  #   Call reusable workflow   #
+  ##############################
+  call-workflow-passing-data:
+    name: "Run"
+    permissions:
+      id-token: write # For OIDC
+      contents: write # For release tags
+    needs:
+      - job_initialize_pipeline
+    uses: ./.github/workflows/avm.template.module.yml
+    with:
+      workflowInput: "${{ needs.job_initialize_pipeline.outputs.workflowInput }}"
+      moduleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.moduleTestFilePaths }}"
+      psRuleModuleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.psRuleModuleTestFilePaths }}"
+      modulePath: "${{ needs.job_initialize_pipeline.outputs.modulePath}}"
+    secrets: inherit
diff --git a/.github/workflows/avm.ptn.azd.container-apps.yml b/.github/workflows/avm.ptn.azd.container-apps.yml
new file mode 100644
index 0000000000..0759231151
--- /dev/null
+++ b/.github/workflows/avm.ptn.azd.container-apps.yml
@@ -0,0 +1,88 @@
+name: "avm.ptn.azd.container-apps"
+
+on:
+  workflow_dispatch:
+    inputs:
+      staticValidation:
+        type: boolean
+        description: "Execute static validation"
+        required: false
+        default: true
+      deploymentValidation:
+        type: boolean
+        description: "Execute deployment validation"
+        required: false
+        default: true
+      removeDeployment:
+        type: boolean
+        description: "Remove deployed module"
+        required: false
+        default: true
+      customLocation:
+        type: string
+        description: "Default location overwrite (e.g., eastus)"
+        required: false
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/actions/templates/avm-**"
+      - ".github/workflows/avm.template.module.yml"
+      - ".github/workflows/avm.ptn.azd.container-apps.yml"
+      - "avm/ptn/azd/container-apps/**"
+      - "avm/utilities/pipelines/**"
+      - "!avm/utilities/pipelines/platform/**"
+      - "!*/**/README.md"
+
+env:
+  modulePath: "avm/ptn/azd/container-apps"
+  workflowPath: ".github/workflows/avm.ptn.azd.container-apps.yml"
+
+concurrency:
+  group: ${{ github.workflow }}
+
+jobs:
+  ###########################
+  #   Initialize pipeline   #
+  ###########################
+  job_initialize_pipeline:
+    runs-on: ubuntu-latest
+    name: "Initialize pipeline"
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: "Set input parameters to output variables"
+        id: get-workflow-param
+        uses: ./.github/actions/templates/avm-getWorkflowInput
+        with:
+          workflowPath: "${{ env.workflowPath}}"
+      - name: "Get module test file paths"
+        id: get-module-test-file-paths
+        uses: ./.github/actions/templates/avm-getModuleTestFiles
+        with:
+          modulePath: "${{ env.modulePath }}"
+    outputs:
+      workflowInput: ${{ steps.get-workflow-param.outputs.workflowInput }}
+      moduleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.moduleTestFilePaths }}
+      psRuleModuleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.psRuleModuleTestFilePaths }}
+      modulePath: "${{ env.modulePath }}"
+
+  ##############################
+  #   Call reusable workflow   #
+  ##############################
+  call-workflow-passing-data:
+    name: "Run"
+    permissions:
+      id-token: write # For OIDC
+      contents: write # For release tags
+    needs:
+      - job_initialize_pipeline
+    uses: ./.github/workflows/avm.template.module.yml
+    with:
+      workflowInput: "${{ needs.job_initialize_pipeline.outputs.workflowInput }}"
+      moduleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.moduleTestFilePaths }}"
+      psRuleModuleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.psRuleModuleTestFilePaths }}"
+      modulePath: "${{ needs.job_initialize_pipeline.outputs.modulePath}}"
+    secrets: inherit
diff --git a/.github/workflows/avm.res.container-service.managed-cluster.yml b/.github/workflows/avm.res.container-service.managed-cluster.yml
index e8c992b399..aae1ec01f4 100644
--- a/.github/workflows/avm.res.container-service.managed-cluster.yml
+++ b/.github/workflows/avm.res.container-service.managed-cluster.yml
@@ -46,7 +46,7 @@ jobs:
   #   Initialize pipeline   #
   ###########################
   job_initialize_pipeline:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     name: "Initialize pipeline"
     steps:
       - name: "Checkout"
diff --git a/.github/workflows/avm.res.web.hosting-environment.yml b/.github/workflows/avm.res.web.hosting-environment.yml
index bd38a4d590..5ae62e6a11 100644
--- a/.github/workflows/avm.res.web.hosting-environment.yml
+++ b/.github/workflows/avm.res.web.hosting-environment.yml
@@ -46,7 +46,7 @@ jobs:
   #   Initialize pipeline   #
   ###########################
   job_initialize_pipeline:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     name: "Initialize pipeline"
     steps:
       - name: "Checkout"
diff --git a/.github/workflows/avm.template.module.yml b/.github/workflows/avm.template.module.yml
index 2046acf948..4df961c68e 100644
--- a/.github/workflows/avm.template.module.yml
+++ b/.github/workflows/avm.template.module.yml
@@ -25,6 +25,7 @@ env:
   ARM_MGMTGROUP_ID: "${{ secrets.ARM_MGMTGROUP_ID }}"
   ARM_TENANT_ID: "${{ secrets.ARM_TENANT_ID }}"
   TOKEN_NAMEPREFIX: "${{ secrets.TOKEN_NAMEPREFIX }}"
+  CI_KEY_VAULT_NAME: "${{ vars.CI_KEY_VAULT_NAME }}"
 
 jobs:
   #########################
diff --git a/.github/workflows/platform.ci-tests.yml b/.github/workflows/platform.ci-tests.yml
index 9ffd0d6ee9..44f509c72d 100644
--- a/.github/workflows/platform.ci-tests.yml
+++ b/.github/workflows/platform.ci-tests.yml
@@ -46,7 +46,7 @@ jobs:
   #   Removal   #
   ###############
   job_run_tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     name: "Run CI tests"
     needs:
       - job_initialize_pipeline
diff --git a/.github/workflows/platform.deployment.history.cleanup.yml b/.github/workflows/platform.deployment.history.cleanup.yml
index 064514271d..d098f1cae6 100644
--- a/.github/workflows/platform.deployment.history.cleanup.yml
+++ b/.github/workflows/platform.deployment.history.cleanup.yml
@@ -48,8 +48,11 @@ jobs:
   #   Removal   #
   ###############
   job_cleanup_subscription_deployments:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     name: "Remove Subscription deployments"
+    environment: avm-validation
+    permissions:
+      id-token: write # For OIDC
     needs:
       - job_initialize_pipeline
     if: ${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).handleSubscriptionScope == 'true' }}
@@ -62,10 +65,17 @@ jobs:
       - name: Set environment
         uses: ./.github/actions/templates/avm-setEnvironment
 
+      # [Azure login] task(s)
+      # ------------------------------
+      # Supports both OIDC and service principal with secret
+      # 'creds' will be ignored if 'client-id', 'subscription-id' or 'tenant-id' is set
       - name: Azure Login
         uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.VALIDATE_CLIENT_ID }}
+          tenant-id: ${{ secrets.VALIDATE_TENANT_ID }}
+          subscription-id: ${{ secrets.VALIDATE_SUBSCRIPTION_ID }}
           enable-AzPSSession: true
 
       - name: Remove deployments
@@ -87,8 +97,11 @@ jobs:
           azPSVersion: "latest"
 
   job_cleanup_managementGroup_deployments:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     name: "Remove Management Group deployments"
+    environment: avm-validation
+    permissions:
+      id-token: write # For OIDC
     needs:
       - job_initialize_pipeline
     if: ${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).handleManagementGroupScope == 'true' }}
@@ -101,10 +114,17 @@ jobs:
       - name: Set environment
         uses: ./.github/actions/templates/avm-setEnvironment
 
+      # [Azure login] task(s)
+      # ------------------------------
+      # Supports both OIDC and service principal with secret
+      # 'creds' will be ignored if 'client-id', 'subscription-id' or 'tenant-id' is set
       - name: Azure Login
         uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.VALIDATE_CLIENT_ID }}
+          tenant-id: ${{ secrets.VALIDATE_TENANT_ID }}
+          subscription-id: ${{ secrets.VALIDATE_SUBSCRIPTION_ID }}
           enable-AzPSSession: true
 
       - name: Remove deployments
@@ -114,13 +134,18 @@ jobs:
             # Load used functions
             . (Join-Path $env:GITHUB_WORKSPACE 'avm' 'utilities' 'pipelines' 'platform' 'deploymentRemoval' 'Clear-ManagementGroupDeploymentHistory.ps1')
 
-            $functionInput = @{
-              ManagementGroupId            = '${{ secrets.ARM_MGMTGROUP_ID }}'
-              maxDeploymentRetentionInDays = '${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).maxDeploymentRetentionInDays }}'
-            }
+            $mgmtGroupIdInput = '${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).customManagementGroupId }}'
 
-            Write-Verbose "Invoke task with" -Verbose
-            Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
+            foreach($mgmtGroupId in @('${{ secrets.ARM_MGMTGROUP_ID }}', 'bicep-lz-vending-automation-child')) {
+              Write-Verbose "Processing mgmtGroupId [$mgmtGroupId]" -Verbose
+              $functionInput = @{
+                ManagementGroupId            = $mgmtGroupId
+                maxDeploymentRetentionInDays = '${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).maxDeploymentRetentionInDays }}'
+              }
 
-            Clear-ManagementGroupDeploymentHistory @functionInput
+              Write-Verbose "Invoke task with" -Verbose
+              Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
+
+              Clear-ManagementGroupDeploymentHistory @functionInput
+            }
           azPSVersion: "latest"
diff --git a/.github/workflows/platform.set-avm-github-pr-labels.yml b/.github/workflows/platform.set-avm-github-pr-labels.yml
new file mode 100644
index 0000000000..e273937a9d
--- /dev/null
+++ b/.github/workflows/platform.set-avm-github-pr-labels.yml
@@ -0,0 +1,42 @@
+# Workflow for adding labels to newly created PRs
+name: .Platform - Set AVM GitHub PR labels
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review]
+
+jobs:
+  SetAvmGitHubPrLabels:
+    if: github.repository == 'Azure/bicep-registry-modules'
+    name: Set-AvmGitHubPrLabels
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: tibdex/github-app-token@v2
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TEAM_LINTER_APP_ID }}
+          private_key: ${{ secrets.TEAM_LINTER_PRIVATE_KEY }}
+      - name: "Run scripts"
+        shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |
+          # Load used functions
+          . (Join-Path $env:GITHUB_WORKSPACE 'avm' 'utilities' 'pipelines' 'platform' 'Set-AvmGitHubPrLabels.ps1')
+
+          $functionInput = @{
+            RepoRoot = $env:GITHUB_WORKSPACE
+            Repo     = "${{ github.repository_owner }}/${{ github.event.repository.name }}"
+            PrUrl = "${{ github.event.pull_request.url }}"
+          }
+
+          Write-Verbose "Invoke task with" -Verbose
+          Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
+
+          Set-AvmGitHubPrLabels @functionInput -Verbose # -WhatIf
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
index b6e76c35ad..b36c59714e 100644
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -4,4 +4,4 @@
     "editorconfig.editorconfig",
     "ms-vscode.powershell"
   ]
-}
\ No newline at end of file
+}
diff --git a/avm/ptn/aca-lza/hosting-environment/README.md b/avm/ptn/aca-lza/hosting-environment/README.md
new file mode 100644
index 0000000000..4754ccdb4d
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/README.md
@@ -0,0 +1,843 @@
+# Container Apps Landing Zone Accelerator `[AcaLza/HostingEnvironment]`
+
+This Azure Container Apps pattern module represents an Azure Container Apps deployment aligned with the cloud adoption framework
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Usage examples](#Usage-examples)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+- [Cross-referenced modules](#Cross-referenced-modules)
+- [Data Collection](#Data-Collection)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.App/containerApps` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2023-05-01/containerApps) |
+| `Microsoft.App/managedEnvironments` | [2023-11-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2023-11-02-preview/managedEnvironments) |
+| `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
+| `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
+| `Microsoft.Automanage/configurationProfileAssignments` | [2022-05-04](https://learn.microsoft.com/en-us/azure/templates) |
+| `Microsoft.Cdn/profiles` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles) |
+| `Microsoft.Cdn/profiles/afdEndpoints` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/afdEndpoints) |
+| `Microsoft.Cdn/profiles/afdEndpoints/routes` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/afdEndpoints/routes) |
+| `Microsoft.Cdn/profiles/customDomains` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/customDomains) |
+| `Microsoft.Cdn/profiles/endpoints` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2021-06-01/profiles/endpoints) |
+| `Microsoft.Cdn/profiles/endpoints/origins` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2021-06-01/profiles/endpoints/origins) |
+| `Microsoft.Cdn/profiles/originGroups` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/originGroups) |
+| `Microsoft.Cdn/profiles/originGroups/origins` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/originGroups/origins) |
+| `Microsoft.Cdn/profiles/ruleSets` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/ruleSets) |
+| `Microsoft.Cdn/profiles/ruleSets/rules` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/ruleSets/rules) |
+| `Microsoft.Cdn/profiles/secrets` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Cdn/2023-05-01/profiles/secrets) |
+| `Microsoft.Compute/virtualMachines` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2023-09-01/virtualMachines) |
+| `Microsoft.Compute/virtualMachines/extensions` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2022-11-01/virtualMachines/extensions) |
+| `Microsoft.ContainerRegistry/registries` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries) |
+| `Microsoft.ContainerRegistry/registries/cacheRules` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/cacheRules) |
+| `Microsoft.ContainerRegistry/registries/replications` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/replications) |
+| `Microsoft.ContainerRegistry/registries/webhooks` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/webhooks) |
+| `Microsoft.DevTestLab/schedules` | [2018-09-15](https://learn.microsoft.com/en-us/azure/templates/Microsoft.DevTestLab/2018-09-15/schedules) |
+| `Microsoft.GuestConfiguration/guestConfigurationAssignments` | [2020-06-25](https://learn.microsoft.com/en-us/azure/templates/Microsoft.GuestConfiguration/2020-06-25/guestConfigurationAssignments) |
+| `Microsoft.Insights/components` | [2020-02-02](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2020-02-02/components) |
+| `microsoft.insights/components/linkedStorageAccounts` | [2020-03-01-preview](https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/2020-03-01-preview/components/linkedStorageAccounts) |
+| `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
+| `Microsoft.KeyVault/vaults` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults) |
+| `Microsoft.KeyVault/vaults/accessPolicies` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/accessPolicies) |
+| `Microsoft.KeyVault/vaults/keys` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/keys) |
+| `Microsoft.KeyVault/vaults/secrets` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2023-07-01/vaults/secrets) |
+| `Microsoft.KeyVault/vaults/secrets` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/secrets) |
+| `Microsoft.Maintenance/configurationAssignments` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Maintenance/2023-04-01/configurationAssignments) |
+| `Microsoft.Maintenance/maintenanceConfigurations` | [2023-10-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Maintenance/maintenanceConfigurations) |
+| `Microsoft.ManagedIdentity/userAssignedIdentities` | [2023-01-31](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2023-01-31/userAssignedIdentities) |
+| `Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials` | [2023-01-31](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2023-01-31/userAssignedIdentities/federatedIdentityCredentials) |
+| `Microsoft.Network/applicationGateways` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/applicationGateways) |
+| `Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-11-01/ApplicationGatewayWebApplicationFirewallPolicies) |
+| `Microsoft.Network/networkInterfaces` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkInterfaces) |
+| `Microsoft.Network/networkSecurityGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/networkSecurityGroups) |
+| `Microsoft.Network/networkSecurityGroups/securityRules` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/networkSecurityGroups/securityRules) |
+| `Microsoft.Network/privateDnsZones` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones) |
+| `Microsoft.Network/privateDnsZones/A` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/A) |
+| `Microsoft.Network/privateDnsZones/AAAA` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/AAAA) |
+| `Microsoft.Network/privateDnsZones/CNAME` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/CNAME) |
+| `Microsoft.Network/privateDnsZones/MX` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/MX) |
+| `Microsoft.Network/privateDnsZones/PTR` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/PTR) |
+| `Microsoft.Network/privateDnsZones/SOA` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/SOA) |
+| `Microsoft.Network/privateDnsZones/SRV` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/SRV) |
+| `Microsoft.Network/privateDnsZones/TXT` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/TXT) |
+| `Microsoft.Network/privateDnsZones/virtualNetworkLinks` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/virtualNetworkLinks) |
+| `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateLinkServices` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateLinkServices) |
+| `Microsoft.Network/publicIPAddresses` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-09-01/publicIPAddresses) |
+| `Microsoft.Network/routeTables` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/routeTables) |
+| `Microsoft.Network/virtualNetworks` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/virtualNetworks) |
+| `Microsoft.Network/virtualNetworks/subnets` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/virtualNetworks/subnets) |
+| `Microsoft.Network/virtualNetworks/subnets` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualNetworks/subnets) |
+| `Microsoft.Network/virtualNetworks/virtualNetworkPeerings` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/virtualNetworks/virtualNetworkPeerings) |
+| `Microsoft.OperationalInsights/workspaces` | [2022-10-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2022-10-01/workspaces) |
+| `Microsoft.OperationalInsights/workspaces/dataExports` | [2020-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2020-08-01/workspaces/dataExports) |
+| `Microsoft.OperationalInsights/workspaces/dataSources` | [2020-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2020-08-01/workspaces/dataSources) |
+| `Microsoft.OperationalInsights/workspaces/linkedServices` | [2020-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2020-08-01/workspaces/linkedServices) |
+| `Microsoft.OperationalInsights/workspaces/linkedStorageAccounts` | [2020-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2020-08-01/workspaces/linkedStorageAccounts) |
+| `Microsoft.OperationalInsights/workspaces/savedSearches` | [2020-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2020-08-01/workspaces/savedSearches) |
+| `Microsoft.OperationalInsights/workspaces/storageInsightConfigs` | [2020-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2020-08-01/workspaces/storageInsightConfigs) |
+| `Microsoft.OperationalInsights/workspaces/tables` | [2022-10-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2022-10-01/workspaces/tables) |
+| `Microsoft.OperationsManagement/solutions` | [2015-11-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationsManagement/2015-11-01-preview/solutions) |
+| `Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems` | [2023-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.RecoveryServices/2023-01-01/vaults/backupFabrics/protectionContainers/protectedItems) |
+| `Microsoft.Resources/resourceGroups` | [2021-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Resources/2021-04-01/resourceGroups) |
+
+## Usage examples
+
+The following section provides usage examples for the module, which were used to validate and deploy the module successfully. For a full reference, please review the module's test folder in its repository.
+
+>**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order.
+
+>**Note**: To reference the module, please use the following syntax `br/public:avm/ptn/aca-lza/hosting-environment:<version>`.
+
+- [Using only defaults.](#example-1-using-only-defaults)
+- [Using a hub and spoke deployment.](#example-2-using-a-hub-and-spoke-deployment)
+- [Using all the available options in WAF aligned values.](#example-3-using-all-the-available-options-in-waf-aligned-values)
+
+### Example 1: _Using only defaults._
+
+This instance deploys the module with the minimum set of required parameters.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module hostingEnvironment 'br/public:avm/ptn/aca-lza/hosting-environment:<version>' = {
+  name: 'hostingEnvironmentDeployment'
+  params: {
+    // Required parameters
+    applicationGatewayCertificateKeyName: 'appgwcert'
+    enableApplicationInsights: true
+    enableDaprInstrumentation: false
+    spokeApplicationGatewaySubnetAddressPrefix: '10.1.3.0/24'
+    spokeInfraSubnetAddressPrefix: '10.1.0.0/23'
+    spokePrivateEndpointsSubnetAddressPrefix: '10.1.2.0/27'
+    spokeVNetAddressPrefixes: [
+      '10.1.0.0/22'
+    ]
+    vmAdminPassword: '<vmAdminPassword>'
+    vmAdminUsername: 'vmadmin'
+    vmJumpBoxSubnetAddressPrefix: '10.1.2.32/27'
+    vmLinuxSshAuthorizedKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain'
+    vmSize: 'Standard_B1s'
+    // Non-required parameters
+    location: '<location>'
+    tags: {
+      environment: 'test'
+    }
+    vmAuthenticationType: 'sshPublicKey'
+    vmJumpboxOSType: 'linux'
+    workloadName: '<workloadName>'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "applicationGatewayCertificateKeyName": {
+      "value": "appgwcert"
+    },
+    "enableApplicationInsights": {
+      "value": true
+    },
+    "enableDaprInstrumentation": {
+      "value": false
+    },
+    "spokeApplicationGatewaySubnetAddressPrefix": {
+      "value": "10.1.3.0/24"
+    },
+    "spokeInfraSubnetAddressPrefix": {
+      "value": "10.1.0.0/23"
+    },
+    "spokePrivateEndpointsSubnetAddressPrefix": {
+      "value": "10.1.2.0/27"
+    },
+    "spokeVNetAddressPrefixes": {
+      "value": [
+        "10.1.0.0/22"
+      ]
+    },
+    "vmAdminPassword": {
+      "value": "<vmAdminPassword>"
+    },
+    "vmAdminUsername": {
+      "value": "vmadmin"
+    },
+    "vmJumpBoxSubnetAddressPrefix": {
+      "value": "10.1.2.32/27"
+    },
+    "vmLinuxSshAuthorizedKey": {
+      "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain"
+    },
+    "vmSize": {
+      "value": "Standard_B1s"
+    },
+    // Non-required parameters
+    "location": {
+      "value": "<location>"
+    },
+    "tags": {
+      "value": {
+        "environment": "test"
+      }
+    },
+    "vmAuthenticationType": {
+      "value": "sshPublicKey"
+    },
+    "vmJumpboxOSType": {
+      "value": "linux"
+    },
+    "workloadName": {
+      "value": "<workloadName>"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 2: _Using a hub and spoke deployment._
+
+This instance deploys the module including a Hub to peer to.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module hostingEnvironment 'br/public:avm/ptn/aca-lza/hosting-environment:<version>' = {
+  name: 'hostingEnvironmentDeployment'
+  params: {
+    // Required parameters
+    applicationGatewayCertificateKeyName: 'appgwcert'
+    enableApplicationInsights: true
+    enableDaprInstrumentation: false
+    spokeApplicationGatewaySubnetAddressPrefix: '10.1.3.0/24'
+    spokeInfraSubnetAddressPrefix: '10.1.0.0/23'
+    spokePrivateEndpointsSubnetAddressPrefix: '10.1.2.0/27'
+    spokeVNetAddressPrefixes: [
+      '10.1.0.0/22'
+    ]
+    vmAdminPassword: '<vmAdminPassword>'
+    vmAdminUsername: 'vmadmin'
+    vmJumpBoxSubnetAddressPrefix: '10.1.2.32/27'
+    vmLinuxSshAuthorizedKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain'
+    vmSize: 'Standard_B1s'
+    // Non-required parameters
+    deployZoneRedundantResources: true
+    enableDdosProtection: true
+    environment: 'dev'
+    exposeContainerAppsWith: 'applicationGateway'
+    hubVirtualNetworkResourceId: '<hubVirtualNetworkResourceId>'
+    location: '<location>'
+    networkApplianceIpAddress: '<networkApplianceIpAddress>'
+    storageAccountType: 'Premium_LRS'
+    tags: {
+      environment: 'test'
+    }
+    vmAuthenticationType: 'sshPublicKey'
+    vmJumpboxOSType: 'linux'
+    workloadName: '<workloadName>'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "applicationGatewayCertificateKeyName": {
+      "value": "appgwcert"
+    },
+    "enableApplicationInsights": {
+      "value": true
+    },
+    "enableDaprInstrumentation": {
+      "value": false
+    },
+    "spokeApplicationGatewaySubnetAddressPrefix": {
+      "value": "10.1.3.0/24"
+    },
+    "spokeInfraSubnetAddressPrefix": {
+      "value": "10.1.0.0/23"
+    },
+    "spokePrivateEndpointsSubnetAddressPrefix": {
+      "value": "10.1.2.0/27"
+    },
+    "spokeVNetAddressPrefixes": {
+      "value": [
+        "10.1.0.0/22"
+      ]
+    },
+    "vmAdminPassword": {
+      "value": "<vmAdminPassword>"
+    },
+    "vmAdminUsername": {
+      "value": "vmadmin"
+    },
+    "vmJumpBoxSubnetAddressPrefix": {
+      "value": "10.1.2.32/27"
+    },
+    "vmLinuxSshAuthorizedKey": {
+      "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain"
+    },
+    "vmSize": {
+      "value": "Standard_B1s"
+    },
+    // Non-required parameters
+    "deployZoneRedundantResources": {
+      "value": true
+    },
+    "enableDdosProtection": {
+      "value": true
+    },
+    "environment": {
+      "value": "dev"
+    },
+    "exposeContainerAppsWith": {
+      "value": "applicationGateway"
+    },
+    "hubVirtualNetworkResourceId": {
+      "value": "<hubVirtualNetworkResourceId>"
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "networkApplianceIpAddress": {
+      "value": "<networkApplianceIpAddress>"
+    },
+    "storageAccountType": {
+      "value": "Premium_LRS"
+    },
+    "tags": {
+      "value": {
+        "environment": "test"
+      }
+    },
+    "vmAuthenticationType": {
+      "value": "sshPublicKey"
+    },
+    "vmJumpboxOSType": {
+      "value": "linux"
+    },
+    "workloadName": {
+      "value": "<workloadName>"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 3: _Using all the available options in WAF aligned values._
+
+This instance deploys the module with the all the available parameters in WAF aligned values.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module hostingEnvironment 'br/public:avm/ptn/aca-lza/hosting-environment:<version>' = {
+  name: 'hostingEnvironmentDeployment'
+  params: {
+    // Required parameters
+    applicationGatewayCertificateKeyName: 'appgwcert'
+    enableApplicationInsights: true
+    enableDaprInstrumentation: false
+    spokeApplicationGatewaySubnetAddressPrefix: '10.1.3.0/24'
+    spokeInfraSubnetAddressPrefix: '10.1.0.0/23'
+    spokePrivateEndpointsSubnetAddressPrefix: '10.1.2.0/27'
+    spokeVNetAddressPrefixes: [
+      '10.1.0.0/22'
+    ]
+    vmAdminPassword: '<vmAdminPassword>'
+    vmAdminUsername: 'vmadmin'
+    vmJumpBoxSubnetAddressPrefix: '10.1.2.32/27'
+    vmLinuxSshAuthorizedKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain'
+    vmSize: 'Standard_B1s'
+    // Non-required parameters
+    deployZoneRedundantResources: true
+    enableDdosProtection: true
+    environment: 'dev'
+    exposeContainerAppsWith: 'applicationGateway'
+    location: '<location>'
+    storageAccountType: 'Premium_LRS'
+    tags: {
+      environment: 'test'
+    }
+    vmAuthenticationType: 'sshPublicKey'
+    vmJumpboxOSType: 'linux'
+    workloadName: '<workloadName>'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "applicationGatewayCertificateKeyName": {
+      "value": "appgwcert"
+    },
+    "enableApplicationInsights": {
+      "value": true
+    },
+    "enableDaprInstrumentation": {
+      "value": false
+    },
+    "spokeApplicationGatewaySubnetAddressPrefix": {
+      "value": "10.1.3.0/24"
+    },
+    "spokeInfraSubnetAddressPrefix": {
+      "value": "10.1.0.0/23"
+    },
+    "spokePrivateEndpointsSubnetAddressPrefix": {
+      "value": "10.1.2.0/27"
+    },
+    "spokeVNetAddressPrefixes": {
+      "value": [
+        "10.1.0.0/22"
+      ]
+    },
+    "vmAdminPassword": {
+      "value": "<vmAdminPassword>"
+    },
+    "vmAdminUsername": {
+      "value": "vmadmin"
+    },
+    "vmJumpBoxSubnetAddressPrefix": {
+      "value": "10.1.2.32/27"
+    },
+    "vmLinuxSshAuthorizedKey": {
+      "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain"
+    },
+    "vmSize": {
+      "value": "Standard_B1s"
+    },
+    // Non-required parameters
+    "deployZoneRedundantResources": {
+      "value": true
+    },
+    "enableDdosProtection": {
+      "value": true
+    },
+    "environment": {
+      "value": "dev"
+    },
+    "exposeContainerAppsWith": {
+      "value": "applicationGateway"
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "storageAccountType": {
+      "value": "Premium_LRS"
+    },
+    "tags": {
+      "value": {
+        "environment": "test"
+      }
+    },
+    "vmAuthenticationType": {
+      "value": "sshPublicKey"
+    },
+    "vmJumpboxOSType": {
+      "value": "linux"
+    },
+    "workloadName": {
+      "value": "<workloadName>"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`applicationGatewayCertificateKeyName`](#parameter-applicationgatewaycertificatekeyname) | string | The name of the certificate key to use for Application Gateway certificate. |
+| [`enableApplicationInsights`](#parameter-enableapplicationinsights) | bool | Enable or disable the createion of Application Insights. |
+| [`enableDaprInstrumentation`](#parameter-enabledaprinstrumentation) | bool | Enable or disable Dapr Application Instrumentation Key used for Dapr telemetry. If Application Insights is not enabled, this parameter is ignored. |
+| [`spokeApplicationGatewaySubnetAddressPrefix`](#parameter-spokeapplicationgatewaysubnetaddressprefix) | string | CIDR of the Spoke Application Gateway Subnet. |
+| [`spokeInfraSubnetAddressPrefix`](#parameter-spokeinfrasubnetaddressprefix) | string | CIDR of the Spoke Infrastructure Subnet. |
+| [`spokePrivateEndpointsSubnetAddressPrefix`](#parameter-spokeprivateendpointssubnetaddressprefix) | string | CIDR of the Spoke Private Endpoints Subnet. |
+| [`spokeVNetAddressPrefixes`](#parameter-spokevnetaddressprefixes) | array | CIDR of the Spoke Virtual Network. |
+| [`vmAdminPassword`](#parameter-vmadminpassword) | securestring | The password to use for the virtual machine. |
+| [`vmAdminUsername`](#parameter-vmadminusername) | string | The username to use for the virtual machine. |
+| [`vmJumpBoxSubnetAddressPrefix`](#parameter-vmjumpboxsubnetaddressprefix) | string | CIDR to use for the virtual machine subnet. |
+| [`vmLinuxSshAuthorizedKey`](#parameter-vmlinuxsshauthorizedkey) | securestring | The SSH public key to use for the virtual machine. |
+| [`vmSize`](#parameter-vmsize) | string | The size of the virtual machine to create. See https://learn.microsoft.com/azure/virtual-machines/sizes for more information. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`applicationGatewayFqdn`](#parameter-applicationgatewayfqdn) | string | The FQDN of the Application Gateway. Required and must match if the TLS Certificate is provided. Default is empty. |
+| [`base64Certificate`](#parameter-base64certificate) | string | The base64 encoded certificate to use for Application Gateway certificate. If this is provided, the certificate will be added to the Key Vault and assigned to the Application Gateway listener. Default is empty. |
+| [`bastionResourceId`](#parameter-bastionresourceid) | string | The resource ID of the bastion host. If set, the spoke virtual network will be peered with the hub virtual network and the bastion host will be allowed to connect to the jump box. Default is empty. |
+| [`deploySampleApplication`](#parameter-deploysampleapplication) | bool | Deploy sample application to the container apps environment. Default is false. |
+| [`deployZoneRedundantResources`](#parameter-deployzoneredundantresources) | bool | Default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false. Default is true. |
+| [`enableDdosProtection`](#parameter-enableddosprotection) | bool | DDoS protection mode. see https://learn.microsoft.com/azure/ddos-protection/ddos-protection-sku-comparison#skus. Default is "false". |
+| [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
+| [`environment`](#parameter-environment) | string | The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long. Default is "test". |
+| [`exposeContainerAppsWith`](#parameter-exposecontainerappswith) | string | Specify the way container apps is going to be exposed. Options are applicationGateway or frontDoor. Default is "applicationGateway". |
+| [`hubVirtualNetworkResourceId`](#parameter-hubvirtualnetworkresourceid) | string | The resource ID of the hub virtual network. If set, the spoke virtual network will be peered with the hub virtual network. Default is empty. |
+| [`location`](#parameter-location) | string | The location of the Azure Container Apps deployment. Default is the location of the deployment location. |
+| [`networkApplianceIpAddress`](#parameter-networkapplianceipaddress) | string | If set, the spoke virtual network will be peered with the hub virtual network and egres traffic will be routed through the network appliance. Default is empty. |
+| [`spokeResourceGroupName`](#parameter-spokeresourcegroupname) | string | The name of the resource group to create the resources in. If set, it overrides the name generated by the template. Default is empty. |
+| [`storageAccountType`](#parameter-storageaccounttype) | string | The storage account type to use for the jump box. Defaults to Standard_LRS. |
+| [`tags`](#parameter-tags) | object | Tags related to the Azure Container Apps deployment. Default is empty. |
+| [`vmAuthenticationType`](#parameter-vmauthenticationtype) | string | Type of authentication to use on the Virtual Machine. SSH key is recommended. Default is "password". |
+| [`vmJumpboxOSType`](#parameter-vmjumpboxostype) | string | The operating system type of the virtual machine. Default is "none" which results in no VM deployment. Default is "none". |
+| [`workloadName`](#parameter-workloadname) | string | The name of the workload that is being deployed. Up to 10 characters long. |
+
+### Parameter: `applicationGatewayCertificateKeyName`
+
+The name of the certificate key to use for Application Gateway certificate.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `enableApplicationInsights`
+
+Enable or disable the createion of Application Insights.
+
+- Required: Yes
+- Type: bool
+
+### Parameter: `enableDaprInstrumentation`
+
+Enable or disable Dapr Application Instrumentation Key used for Dapr telemetry. If Application Insights is not enabled, this parameter is ignored.
+
+- Required: Yes
+- Type: bool
+
+### Parameter: `spokeApplicationGatewaySubnetAddressPrefix`
+
+CIDR of the Spoke Application Gateway Subnet.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `spokeInfraSubnetAddressPrefix`
+
+CIDR of the Spoke Infrastructure Subnet.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `spokePrivateEndpointsSubnetAddressPrefix`
+
+CIDR of the Spoke Private Endpoints Subnet.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `spokeVNetAddressPrefixes`
+
+CIDR of the Spoke Virtual Network.
+
+- Required: Yes
+- Type: array
+
+### Parameter: `vmAdminPassword`
+
+The password to use for the virtual machine.
+
+- Required: Yes
+- Type: securestring
+
+### Parameter: `vmAdminUsername`
+
+The username to use for the virtual machine.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `vmJumpBoxSubnetAddressPrefix`
+
+CIDR to use for the virtual machine subnet.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `vmLinuxSshAuthorizedKey`
+
+The SSH public key to use for the virtual machine.
+
+- Required: Yes
+- Type: securestring
+
+### Parameter: `vmSize`
+
+The size of the virtual machine to create. See https://learn.microsoft.com/azure/virtual-machines/sizes for more information.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `applicationGatewayFqdn`
+
+The FQDN of the Application Gateway. Required and must match if the TLS Certificate is provided. Default is empty.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `base64Certificate`
+
+The base64 encoded certificate to use for Application Gateway certificate. If this is provided, the certificate will be added to the Key Vault and assigned to the Application Gateway listener. Default is empty.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `bastionResourceId`
+
+The resource ID of the bastion host. If set, the spoke virtual network will be peered with the hub virtual network and the bastion host will be allowed to connect to the jump box. Default is empty.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `deploySampleApplication`
+
+Deploy sample application to the container apps environment. Default is false.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
+### Parameter: `deployZoneRedundantResources`
+
+Default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false. Default is true.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+### Parameter: `enableDdosProtection`
+
+DDoS protection mode. see https://learn.microsoft.com/azure/ddos-protection/ddos-protection-sku-comparison#skus. Default is "false".
+
+- Required: No
+- Type: bool
+- Default: `False`
+
+### Parameter: `enableTelemetry`
+
+Enable/Disable usage telemetry for module.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+### Parameter: `environment`
+
+The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long. Default is "test".
+
+- Required: No
+- Type: string
+- Default: `'test'`
+
+### Parameter: `exposeContainerAppsWith`
+
+Specify the way container apps is going to be exposed. Options are applicationGateway or frontDoor. Default is "applicationGateway".
+
+- Required: No
+- Type: string
+- Default: `'applicationGateway'`
+- Allowed:
+  ```Bicep
+  [
+    'applicationGateway'
+    'frontDoor'
+  ]
+  ```
+
+### Parameter: `hubVirtualNetworkResourceId`
+
+The resource ID of the hub virtual network. If set, the spoke virtual network will be peered with the hub virtual network. Default is empty.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `location`
+
+The location of the Azure Container Apps deployment. Default is the location of the deployment location.
+
+- Required: No
+- Type: string
+- Default: `[deployment().location]`
+
+### Parameter: `networkApplianceIpAddress`
+
+If set, the spoke virtual network will be peered with the hub virtual network and egres traffic will be routed through the network appliance. Default is empty.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `spokeResourceGroupName`
+
+The name of the resource group to create the resources in. If set, it overrides the name generated by the template. Default is empty.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `storageAccountType`
+
+The storage account type to use for the jump box. Defaults to Standard_LRS.
+
+- Required: No
+- Type: string
+- Default: `'Standard_LRS'`
+
+### Parameter: `tags`
+
+Tags related to the Azure Container Apps deployment. Default is empty.
+
+- Required: No
+- Type: object
+- Default: `{}`
+
+### Parameter: `vmAuthenticationType`
+
+Type of authentication to use on the Virtual Machine. SSH key is recommended. Default is "password".
+
+- Required: No
+- Type: string
+- Default: `'password'`
+- Allowed:
+  ```Bicep
+  [
+    'password'
+    'sshPublicKey'
+  ]
+  ```
+
+### Parameter: `vmJumpboxOSType`
+
+The operating system type of the virtual machine. Default is "none" which results in no VM deployment. Default is "none".
+
+- Required: No
+- Type: string
+- Default: `'none'`
+- Allowed:
+  ```Bicep
+  [
+    'linux'
+    'none'
+    'windows'
+  ]
+  ```
+
+### Parameter: `workloadName`
+
+The name of the workload that is being deployed. Up to 10 characters long.
+
+- Required: No
+- Type: string
+- Default: `'aca-lza'`
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `applicationGatewayFqdn` | string | The FQDN of the Azure Application Gateway. |
+| `applicationGatewayPublicIp` | string | The public IP address of the Azure Application Gateway. |
+| `applicationGatewayResourceId` | string | The resource ID of the Azure Application Gateway. |
+| `applicationInsightsName` | string | The name of application Insights instance. |
+| `containerAppsEnvironmentName` | string | The name of the container apps environment. |
+| `containerAppsEnvironmentResourceId` | string | The resource ID of the container apps environment. |
+| `containerRegistryLoginServer` | string | The name of the container registry login server. |
+| `containerRegistryName` | string | The name of the container registry. |
+| `containerRegistryResourceId` | string | The resource ID of the container registry. |
+| `containerRegistryUserAssignedIdentityResourceId` | string | The resource ID of the user assigned managed identity for the container registry to be able to pull images from it. |
+| `keyVaultName` | string | The name of the Azure key vault. |
+| `keyVaultResourceId` | string | The resource ID of the key vault. |
+| `logAnalyticsWorkspaceResourceId` | string | The resource ID of the Log Analytics workspace created in the spoke vnet. |
+| `spokeApplicationGatewaySubnetName` | string | The name of the Spoke Application Gateway Subnet.  If "spokeApplicationGatewaySubnetAddressPrefix" is empty, the subnet will not be created and the value returned is empty. |
+| `spokeApplicationGatewaySubnetResourceId` | string | The resource ID of the Spoke Application Gateway Subnet. If "spokeApplicationGatewaySubnetAddressPrefix" is empty, the subnet will not be created and the value returned is empty. |
+| `spokeInfraSubnetName` | string | The name of the Spoke Infrastructure Subnet. |
+| `spokeInfraSubnetResourceId` | string | The resource ID of the Spoke Infrastructure Subnet. |
+| `spokePrivateEndpointsSubnetName` | string | The name of the Spoke Private Endpoints Subnet. |
+| `spokeResourceGroupName` | string | The name of the Spoke resource group. |
+| `spokeVnetName` | string | The name of the Spoke Virtual Network. |
+| `spokeVNetResourceId` | string | The  resource ID of the Spoke Virtual Network. |
+| `vmJumpBoxName` | string | The name of the jump box virtual machine. |
+
+## Cross-referenced modules
+
+This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
+
+| Reference | Type |
+| :-- | :-- |
+| `br/public:avm/res/app/container-app:0.4.0` | Remote reference |
+| `br/public:avm/res/app/managed-environment:0.5.1` | Remote reference |
+| `br/public:avm/res/cdn/profile:0.3.0` | Remote reference |
+| `br/public:avm/res/compute/virtual-machine:0.5.1` | Remote reference |
+| `br/public:avm/res/container-registry/registry:0.3.0` | Remote reference |
+| `br/public:avm/res/insights/component:0.3.1` | Remote reference |
+| `br/public:avm/res/key-vault/vault:0.6.1` | Remote reference |
+| `br/public:avm/res/managed-identity/user-assigned-identity:0.2.1` | Remote reference |
+| `br/public:avm/res/network/application-gateway-web-application-firewall-policy:0.1.0` | Remote reference |
+| `br/public:avm/res/network/application-gateway:0.1.0` | Remote reference |
+| `br/public:avm/res/network/network-security-group:0.2.0` | Remote reference |
+| `br/public:avm/res/network/private-dns-zone:0.3.0` | Remote reference |
+| `br/public:avm/res/network/public-ip-address:0.4.1` | Remote reference |
+| `br/public:avm/res/network/route-table:0.2.2` | Remote reference |
+| `br/public:avm/res/network/virtual-network:0.1.6` | Remote reference |
+| `br/public:avm/res/operational-insights/workspace:0.3.4` | Remote reference |
+| `br/public:avm/res/resources/resource-group:0.2.3` | Remote reference |
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the [repository](https://aka.ms/avm/telemetry). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
diff --git a/avm/ptn/aca-lza/hosting-environment/main.bicep b/avm/ptn/aca-lza/hosting-environment/main.bicep
new file mode 100644
index 0000000000..c1bd3b4879
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/main.bicep
@@ -0,0 +1,370 @@
+targetScope = 'subscription'
+
+metadata name = 'Container Apps Landing Zone Accelerator'
+metadata description = 'This Azure Container Apps pattern module represents an Azure Container Apps deployment aligned with the cloud adoption framework'
+metadata owner = 'Azure/module-maintainers'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+// @description('Required. The id of the subscription to create the Azure Container Apps deployment.')
+// param subscriptionId string
+
+@description('Optional. The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string = 'aca-lza'
+
+@description('Optional. The resource ID of the hub virtual network. If set, the spoke virtual network will be peered with the hub virtual network. Default is empty.')
+param hubVirtualNetworkResourceId string = ''
+
+@description('Optional. The resource ID of the bastion host. If set, the spoke virtual network will be peered with the hub virtual network and the bastion host will be allowed to connect to the jump box. Default is empty.')
+param bastionResourceId string = ''
+
+@description('Optional. If set, the spoke virtual network will be peered with the hub virtual network and egres traffic will be routed through the network appliance. Default is empty.')
+param networkApplianceIpAddress string = ''
+
+@description('Optional. Tags related to the Azure Container Apps deployment. Default is empty.')
+param tags object = {}
+
+@description('Optional. The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long. Default is "test".')
+@maxLength(8)
+param environment string = 'test'
+
+@description('Optional. The location of the Azure Container Apps deployment. Default is the location of the deployment location.')
+param location string = deployment().location
+
+// Jumpbox Virtual Machine
+@description('Required. The size of the virtual machine to create. See https://learn.microsoft.com/azure/virtual-machines/sizes for more information.')
+param vmSize string
+
+@description('Optional. The storage account type to use for the jump box. Defaults to Standard_LRS.')
+param storageAccountType string = 'Standard_LRS'
+
+@description('Required. The username to use for the virtual machine.')
+param vmAdminUsername string
+
+@description('Required. The password to use for the virtual machine.')
+@secure()
+param vmAdminPassword string
+
+@description('Required. The SSH public key to use for the virtual machine.')
+@secure()
+param vmLinuxSshAuthorizedKey string
+
+@description('Optional. Type of authentication to use on the Virtual Machine. SSH key is recommended. Default is "password".')
+@allowed([
+  'sshPublicKey'
+  'password'
+])
+param vmAuthenticationType string = 'password'
+
+@allowed(['linux', 'windows', 'none'])
+@description('Optional. The operating system type of the virtual machine. Default is "none" which results in no VM deployment. Default is "none".')
+param vmJumpboxOSType string = 'none'
+
+@description('Required. CIDR to use for the virtual machine subnet.')
+param vmJumpBoxSubnetAddressPrefix string
+
+@description('Optional. The name of the resource group to create the resources in. If set, it overrides the name generated by the template. Default is empty.')
+param spokeResourceGroupName string = ''
+
+@description('Required. CIDR of the Spoke Virtual Network.')
+param spokeVNetAddressPrefixes array
+
+@description('Required. CIDR of the Spoke Infrastructure Subnet.')
+param spokeInfraSubnetAddressPrefix string
+
+@description('Required. CIDR of the Spoke Private Endpoints Subnet.')
+param spokePrivateEndpointsSubnetAddressPrefix string
+
+@description('Required. CIDR of the Spoke Application Gateway Subnet.')
+param spokeApplicationGatewaySubnetAddressPrefix string
+
+@description('Required. Enable or disable the createion of Application Insights.')
+param enableApplicationInsights bool
+
+@description('Required. Enable or disable Dapr Application Instrumentation Key used for Dapr telemetry. If Application Insights is not enabled, this parameter is ignored.')
+param enableDaprInstrumentation bool
+
+@description('Optional. The FQDN of the Application Gateway. Required and must match if the TLS Certificate is provided. Default is empty.')
+param applicationGatewayFqdn string = ''
+
+@description('Optional. The base64 encoded certificate to use for Application Gateway certificate. If this is provided, the certificate will be added to the Key Vault and assigned to the Application Gateway listener. Default is empty.')
+param base64Certificate string = ''
+
+@description('Required. The name of the certificate key to use for Application Gateway certificate.')
+param applicationGatewayCertificateKeyName string
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Optional. Default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false. Default is true.')
+param deployZoneRedundantResources bool = true
+
+// @description('Optional. If true, Azure Policies will be deployed. Default value is true.')
+// param deployAzurePolicies bool = true
+
+@description('Optional. Specify the way container apps is going to be exposed. Options are applicationGateway or frontDoor. Default is "applicationGateway".')
+@allowed([
+  'applicationGateway'
+  'frontDoor'
+])
+param exposeContainerAppsWith string = 'applicationGateway'
+
+@description('Optional. Deploy sample application to the container apps environment. Default is false.')
+param deploySampleApplication bool = false
+
+@description('Optional. DDoS protection mode. see https://learn.microsoft.com/azure/ddos-protection/ddos-protection-sku-comparison#skus. Default is "false".')
+param enableDdosProtection bool = false
+
+// ------------------
+// VARIABLES
+// ------------------
+var namingRules = json(loadTextContent('modules/naming/naming-rules.jsonc'))
+var rgSpokeName = !empty(spokeResourceGroupName)
+  ? spokeResourceGroupName
+  : '${namingRules.resourceTypeAbbreviations.resourceGroup}-${workloadName}-spoke-${environment}-${namingRules.regionAbbreviations[toLower(location)]}'
+
+// ------------------
+// RESOURCES
+// ------------------
+@description('User-configured naming rules')
+module naming 'modules/naming/naming.module.bicep' = {
+  scope: resourceGroup(rgSpokeName)
+  name: take('sharedNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(spoke.outputs.spokeResourceGroupName)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+module spoke 'modules/spoke/deploy.spoke.bicep' = {
+  name: take('spoke-${deployment().name}-deployment', 64)
+  scope: subscription()
+  params: {
+    spokeResourceGroupName: rgSpokeName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    environment: environment
+    //subscriptionId: subscriptionId
+    workloadName: workloadName
+    hubVNetId: hubVirtualNetworkResourceId
+    bastionResourceId: bastionResourceId
+    spokeApplicationGatewaySubnetAddressPrefix: spokeApplicationGatewaySubnetAddressPrefix
+    spokeInfraSubnetAddressPrefix: spokeInfraSubnetAddressPrefix
+    spokePrivateEndpointsSubnetAddressPrefix: spokePrivateEndpointsSubnetAddressPrefix
+    spokeVNetAddressPrefixes: spokeVNetAddressPrefixes
+    networkApplianceIpAddress: networkApplianceIpAddress
+    vmSize: vmSize
+    vmZone: (deployZoneRedundantResources) ? 2 : 0
+    storageAccountType: storageAccountType
+    vmAdminUsername: vmAdminUsername
+    vmAdminPassword: vmAdminPassword
+    vmLinuxSshAuthorizedKey: vmLinuxSshAuthorizedKey
+    vmJumpboxOSType: vmJumpboxOSType
+    vmJumpBoxSubnetAddressPrefix: vmJumpBoxSubnetAddressPrefix
+    vmAuthenticationType: vmAuthenticationType
+  }
+}
+
+// Policy assignement requires a management group scope
+// @description('Assign built-in and custom (container-apps related) policies to the spoke subscription.')
+// module policiesDeployment 'modules/policy/policies-assignement.bicep' = if (deployAzurePolicies) {
+//   name: take('policyAssignments-${deployment().name}', 64)
+//   params: {
+//     location: location
+//     spokeResourceGroupName: spoke.outputs.spokeResourceGroupName
+//     containerRegistryName: naming.outputs.resourcesNames.containerRegistry
+//   }
+// }
+
+module supportingServices 'modules/supporting-services/deploy.supporting-services.bicep' = {
+  name: take('supportingServices-${deployment().name}-deployment', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    spokePrivateEndpointSubnetName: spoke.outputs.spokePrivateEndpointsSubnetName
+    environment: environment
+    workloadName: workloadName
+    spokeVNetId: spoke.outputs.spokeVNetId
+    hubVNetId: hubVirtualNetworkResourceId
+    logAnalyticsWorkspaceId: spoke.outputs.logAnalyticsWorkspaceId
+  }
+}
+
+module containerAppsEnvironment 'modules/container-apps-environment/deploy.aca-environment.bicep' = {
+  name: take('containerAppsEnvironment-${deployment().name}-deployment', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    environment: environment
+    workloadName: workloadName
+    hubVNetId: hubVirtualNetworkResourceId
+    spokeVNetName: spoke.outputs.spokeVNetName
+    spokeInfraSubnetName: spoke.outputs.spokeInfraSubnetName
+    enableApplicationInsights: enableApplicationInsights
+    enableDaprInstrumentation: enableDaprInstrumentation
+    containerRegistryUserAssignedIdentityId: supportingServices.outputs.containerRegistryUserAssignedIdentityId
+    logAnalyticsWorkspaceId: spoke.outputs.logAnalyticsWorkspaceId
+  }
+}
+
+module sampleApplication 'modules/sample-application/deploy.sample-application.bicep' = if (deploySampleApplication) {
+  name: take('sampleApplication-${deployment().name}-deployment', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    containerAppsEnvironmentId: containerAppsEnvironment.outputs.containerAppsEnvironmentId
+    workloadProfileName: containerAppsEnvironment.outputs.workloadProfileNames[0]
+    containerRegistryUserAssignedIdentityId: supportingServices.outputs.containerRegistryUserAssignedIdentityId
+  }
+}
+
+module applicationGateway 'modules/application-gateway/deploy.app-gateway.bicep' = if (exposeContainerAppsWith == 'applicationGateway') {
+  name: take('applicationGateway-${deployment().name}-deployment', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    environment: environment
+    workloadName: workloadName
+    applicationGatewayCertificateKeyName: applicationGatewayCertificateKeyName
+    applicationGatewayFqdn: applicationGatewayFqdn
+    applicationGatewayPrimaryBackendEndFqdn: (deploySampleApplication)
+      ? sampleApplication.outputs.helloWorldAppFqdn
+      : ''
+    applicationGatewaySubnetId: spoke.outputs.spokeApplicationGatewaySubnetId
+    base64Certificate: base64Certificate
+    keyVaultId: supportingServices.outputs.keyVaultResourceId
+    deployZoneRedundantResources: deployZoneRedundantResources
+    enableDdosProtection: enableDdosProtection
+    applicationGatewayLogAnalyticsId: spoke.outputs.logAnalyticsWorkspaceId
+  }
+}
+
+module frontDoor 'modules/front-door/deploy.front-door.bicep' = if (exposeContainerAppsWith == 'frontDoor') {
+  name: take('frontDoor-${deployment().name}-deployment', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    environment: environment
+    workloadName: workloadName
+    containerAppsEnvironmentId: containerAppsEnvironment.outputs.containerAppsEnvironmentId
+    frontDoorOriginHostName: (deploySampleApplication) ? sampleApplication.outputs.helloWorldAppFqdn : ''
+    privateLinkSubnetId: spoke.outputs.spokeInfraSubnetId
+  }
+}
+
+resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) {
+  name: '46d3xbcp.ptn.acalza-hostingenvironment.${substring(uniqueString(deployment().name, location), 0, 4)}'
+  location: location
+  properties: {
+    mode: 'Incremental'
+    template: {
+      '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
+      contentVersion: '1.0.0.0'
+      resources: []
+      outputs: {
+        telemetry: {
+          type: 'String'
+          value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
+        }
+      }
+    }
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+// Spoke
+@description('The name of the Spoke resource group.')
+output spokeResourceGroupName string = spoke.outputs.spokeResourceGroupName
+
+@description('The  resource ID of the Spoke Virtual Network.')
+output spokeVNetResourceId string = spoke.outputs.spokeVNetId
+
+@description('The name of the Spoke Virtual Network.')
+output spokeVnetName string = spoke.outputs.spokeVNetName
+
+@description('The resource ID of the Spoke Infrastructure Subnet.')
+output spokeInfraSubnetResourceId string = spoke.outputs.spokeInfraSubnetId
+
+@description('The name of the Spoke Infrastructure Subnet.')
+output spokeInfraSubnetName string = spoke.outputs.spokeInfraSubnetName
+
+@description('The name of the Spoke Private Endpoints Subnet.')
+output spokePrivateEndpointsSubnetName string = spoke.outputs.spokePrivateEndpointsSubnetName
+
+@description('The resource ID of the Spoke Application Gateway Subnet. If "spokeApplicationGatewaySubnetAddressPrefix" is empty, the subnet will not be created and the value returned is empty.')
+output spokeApplicationGatewaySubnetResourceId string = spoke.outputs.spokeApplicationGatewaySubnetId
+
+@description('The name of the Spoke Application Gateway Subnet.  If "spokeApplicationGatewaySubnetAddressPrefix" is empty, the subnet will not be created and the value returned is empty.')
+output spokeApplicationGatewaySubnetName string = spoke.outputs.spokeApplicationGatewaySubnetName
+
+@description('The resource ID of the Log Analytics workspace created in the spoke vnet.')
+output logAnalyticsWorkspaceResourceId string = spoke.outputs.logAnalyticsWorkspaceId
+
+@description('The name of the jump box virtual machine.')
+output vmJumpBoxName string = spoke.outputs.vmJumpBoxName
+
+// Supporting Services
+@description('The resource ID of the container registry.')
+output containerRegistryResourceId string = supportingServices.outputs.containerRegistryId
+
+@description('The name of the container registry.')
+output containerRegistryName string = supportingServices.outputs.containerRegistryName
+
+@description('The name of the container registry login server.')
+output containerRegistryLoginServer string = supportingServices.outputs.containerRegistryLoginServer
+
+@description('The resource ID of the user assigned managed identity for the container registry to be able to pull images from it.')
+output containerRegistryUserAssignedIdentityResourceId string = supportingServices.outputs.containerRegistryUserAssignedIdentityId
+
+@description('The resource ID of the key vault.')
+output keyVaultResourceId string = supportingServices.outputs.keyVaultResourceId
+
+@description('The name of the Azure key vault.')
+output keyVaultName string = supportingServices.outputs.keyVaultName
+
+// Application Gateway
+@description('The resource ID of the Azure Application Gateway.')
+output applicationGatewayResourceId string = (exposeContainerAppsWith == 'applicationGateway')
+  ? applicationGateway.outputs.applicationGatewayResourceId
+  : ''
+
+@description('The FQDN of the Azure Application Gateway.')
+output applicationGatewayFqdn string = (exposeContainerAppsWith == 'applicationGateway')
+  ? applicationGateway.outputs.applicationGatewayFqdn
+  : ''
+
+@description('The public IP address of the Azure Application Gateway.')
+output applicationGatewayPublicIp string = (exposeContainerAppsWith == 'applicationGateway')
+  ? applicationGateway.outputs.applicationGatewayPublicIp
+  : ''
+
+// Container Apps Environment
+@description('The resource ID of the container apps environment.')
+output containerAppsEnvironmentResourceId string = containerAppsEnvironment.outputs.containerAppsEnvironmentId
+
+@description('The name of the container apps environment.')
+output containerAppsEnvironmentName string = containerAppsEnvironment.outputs.containerAppsEnvironmentName
+
+@description('The name of application Insights instance.')
+output applicationInsightsName string = (enableApplicationInsights)
+  ? containerAppsEnvironment.outputs.applicationInsightsName
+  : ''
diff --git a/avm/ptn/aca-lza/hosting-environment/main.json b/avm/ptn/aca-lza/hosting-environment/main.json
new file mode 100644
index 0000000000..dff005463f
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/main.json
@@ -0,0 +1,43542 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.29.47.4906",
+      "templateHash": "16535725536619244187"
+    },
+    "name": "Container Apps Landing Zone Accelerator",
+    "description": "This Azure Container Apps pattern module represents an Azure Container Apps deployment aligned with the cloud adoption framework",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "workloadName": {
+      "type": "string",
+      "defaultValue": "aca-lza",
+      "minLength": 2,
+      "maxLength": 10,
+      "metadata": {
+        "description": "Optional. The name of the workload that is being deployed. Up to 10 characters long."
+      }
+    },
+    "hubVirtualNetworkResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. The resource ID of the hub virtual network. If set, the spoke virtual network will be peered with the hub virtual network. Default is empty."
+      }
+    },
+    "bastionResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. The resource ID of the bastion host. If set, the spoke virtual network will be peered with the hub virtual network and the bastion host will be allowed to connect to the jump box. Default is empty."
+      }
+    },
+    "networkApplianceIpAddress": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. If set, the spoke virtual network will be peered with the hub virtual network and egres traffic will be routed through the network appliance. Default is empty."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. Tags related to the Azure Container Apps deployment. Default is empty."
+      }
+    },
+    "environment": {
+      "type": "string",
+      "defaultValue": "test",
+      "maxLength": 8,
+      "metadata": {
+        "description": "Optional. The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\"). Up to 8 characters long. Default is \"test\"."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[deployment().location]",
+      "metadata": {
+        "description": "Optional. The location of the Azure Container Apps deployment. Default is the location of the deployment location."
+      }
+    },
+    "vmSize": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The size of the virtual machine to create. See https://learn.microsoft.com/azure/virtual-machines/sizes for more information."
+      }
+    },
+    "storageAccountType": {
+      "type": "string",
+      "defaultValue": "Standard_LRS",
+      "metadata": {
+        "description": "Optional. The storage account type to use for the jump box. Defaults to Standard_LRS."
+      }
+    },
+    "vmAdminUsername": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The username to use for the virtual machine."
+      }
+    },
+    "vmAdminPassword": {
+      "type": "securestring",
+      "metadata": {
+        "description": "Required. The password to use for the virtual machine."
+      }
+    },
+    "vmLinuxSshAuthorizedKey": {
+      "type": "securestring",
+      "metadata": {
+        "description": "Required. The SSH public key to use for the virtual machine."
+      }
+    },
+    "vmAuthenticationType": {
+      "type": "string",
+      "defaultValue": "password",
+      "allowedValues": [
+        "sshPublicKey",
+        "password"
+      ],
+      "metadata": {
+        "description": "Optional. Type of authentication to use on the Virtual Machine. SSH key is recommended. Default is \"password\"."
+      }
+    },
+    "vmJumpboxOSType": {
+      "type": "string",
+      "defaultValue": "none",
+      "allowedValues": [
+        "linux",
+        "windows",
+        "none"
+      ],
+      "metadata": {
+        "description": "Optional. The operating system type of the virtual machine. Default is \"none\" which results in no VM deployment. Default is \"none\"."
+      }
+    },
+    "vmJumpBoxSubnetAddressPrefix": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. CIDR to use for the virtual machine subnet."
+      }
+    },
+    "spokeResourceGroupName": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. The name of the resource group to create the resources in. If set, it overrides the name generated by the template. Default is empty."
+      }
+    },
+    "spokeVNetAddressPrefixes": {
+      "type": "array",
+      "metadata": {
+        "description": "Required. CIDR of the Spoke Virtual Network."
+      }
+    },
+    "spokeInfraSubnetAddressPrefix": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. CIDR of the Spoke Infrastructure Subnet."
+      }
+    },
+    "spokePrivateEndpointsSubnetAddressPrefix": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. CIDR of the Spoke Private Endpoints Subnet."
+      }
+    },
+    "spokeApplicationGatewaySubnetAddressPrefix": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. CIDR of the Spoke Application Gateway Subnet."
+      }
+    },
+    "enableApplicationInsights": {
+      "type": "bool",
+      "metadata": {
+        "description": "Required. Enable or disable the createion of Application Insights."
+      }
+    },
+    "enableDaprInstrumentation": {
+      "type": "bool",
+      "metadata": {
+        "description": "Required. Enable or disable Dapr Application Instrumentation Key used for Dapr telemetry. If Application Insights is not enabled, this parameter is ignored."
+      }
+    },
+    "applicationGatewayFqdn": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. The FQDN of the Application Gateway. Required and must match if the TLS Certificate is provided. Default is empty."
+      }
+    },
+    "base64Certificate": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. The base64 encoded certificate to use for Application Gateway certificate. If this is provided, the certificate will be added to the Key Vault and assigned to the Application Gateway listener. Default is empty."
+      }
+    },
+    "applicationGatewayCertificateKeyName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The name of the certificate key to use for Application Gateway certificate."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for module."
+      }
+    },
+    "deployZoneRedundantResources": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false. Default is true."
+      }
+    },
+    "exposeContainerAppsWith": {
+      "type": "string",
+      "defaultValue": "applicationGateway",
+      "allowedValues": [
+        "applicationGateway",
+        "frontDoor"
+      ],
+      "metadata": {
+        "description": "Optional. Specify the way container apps is going to be exposed. Options are applicationGateway or frontDoor. Default is \"applicationGateway\"."
+      }
+    },
+    "deploySampleApplication": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Deploy sample application to the container apps environment. Default is false."
+      }
+    },
+    "enableDdosProtection": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. DDoS protection mode. see https://learn.microsoft.com/azure/ddos-protection/ddos-protection-sku-comparison#skus. Default is \"false\"."
+      }
+    }
+  },
+  "variables": {
+    "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+    "namingRules": "[json(variables('$fxv#0'))]",
+    "rgSpokeName": "[if(not(empty(parameters('spokeResourceGroupName'))), parameters('spokeResourceGroupName'), format('{0}-{1}-spoke-{2}-{3}', variables('namingRules').resourceTypeAbbreviations.resourceGroup, parameters('workloadName'), parameters('environment'), variables('namingRules').regionAbbreviations[toLower(parameters('location'))]))]"
+  },
+  "resources": [
+    {
+      "condition": "[parameters('enableTelemetry')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2023-07-01",
+      "name": "[format('46d3xbcp.ptn.acalza-hostingenvironment.{0}', substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+      "location": "[parameters('location')]",
+      "properties": {
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "resources": [],
+          "outputs": {
+            "telemetry": {
+              "type": "String",
+              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('sharedNamingDeployment-{0}', deployment().name), 64)]",
+      "resourceGroup": "[variables('rgSpokeName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "uniqueId": {
+            "value": "[uniqueString(reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeResourceGroupName.value)]"
+          },
+          "environment": {
+            "value": "[parameters('environment')]"
+          },
+          "workloadName": {
+            "value": "[parameters('workloadName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "4794676376542080363"
+            }
+          },
+          "parameters": {
+            "workloadName": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 10,
+              "metadata": {
+                "description": "The name of the workloard that is being deployed. Up to 10 characters long."
+              }
+            },
+            "environment": {
+              "type": "string",
+              "maxLength": 8,
+              "metadata": {
+                "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\") Up to 8 characters long."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location for all Resources."
+              }
+            },
+            "uniqueId": {
+              "type": "string",
+              "metadata": {
+                "description": "a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness"
+              }
+            }
+          },
+          "variables": {
+            "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+            "naming": "[json(variables('$fxv#0'))]",
+            "uniqueIdShort": "[substring(parameters('uniqueId'), 0, 5)]",
+            "resourceTypeToken": "RES_TYPE",
+            "namingBase": "[format('{0}-{1}-{2}-{3}', variables('resourceTypeToken'), parameters('workloadName'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+            "namingBaseUnique": "[format('{0}-{1}-{2}-{3}-{4}', variables('resourceTypeToken'), parameters('workloadName'), variables('uniqueIdShort'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+            "namingBaseNoWorkloadName": "[format('{0}-{1}-{2}', variables('resourceTypeToken'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+            "resourceTypeAbbreviations": "[variables('naming').resourceTypeAbbreviations]",
+            "keyVaultName": "[take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault), 24)]",
+            "resourceNames": {
+              "vnetSpoke": "[format('{0}-spoke', replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+              "vnetHub": "[format('{0}-hub', replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+              "applicationGateway": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway)]",
+              "applicationGatewayPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+              "applicationGatewayUserAssignedIdentity": "[format('{0}-{1}-KeyVaultSecretUser', variables('naming').resourceTypeAbbreviations.managedIdentity, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+              "applicationGatewayNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+              "pepNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.privateEndpoint))]",
+              "applicationInsights": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationInsights)]",
+              "azureFirewall": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall)]",
+              "azureFirewallPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall))]",
+              "bastion": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion)]",
+              "bastionNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+              "bastionPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+              "containerAppsEnvironment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment)]",
+              "containerAppsEnvironmentNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment))]",
+              "containerRegistry": "[take(toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')), 50)]",
+              "containerRegistryPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+              "containerRegistryUserAssignedIdentity": "[format('{0}-{1}-AcrPull', variables('naming').resourceTypeAbbreviations.managedIdentity, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+              "redisCache": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache)]",
+              "redisCachePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache))]",
+              "openAiAccount": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cognitiveAccount)]",
+              "openAiDeployment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.openAiDeployment)]",
+              "cosmosDbNoSql": "[toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44))]",
+              "cosmosDbNoSqlPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44)))]",
+              "frontDoorProfile": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+              "keyVault": "[if(endsWith(variables('keyVaultName'), '-'), take(variables('keyVaultName'), 23), variables('keyVaultName'))]",
+              "keyVaultPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault))]",
+              "logAnalyticsWorkspace": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.logAnalyticsWorkspace)]",
+              "routeTable": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.routeTable)]",
+              "serviceBus": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus)]",
+              "serviceBusPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus))]",
+              "storageAccount": "[toLower(take(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount), '-', ''), 24))]",
+              "storageAccountPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount)))]",
+              "vmJumpBox": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine)]",
+              "vmJumpBoxNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+              "vmJumpBoxNic": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkInterface, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+              "frontDoor": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+              "azureAISearch": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch)]",
+              "azureAISearchPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch))]",
+              "documentIntelligence": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence)]",
+              "documentIntelligencePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence))]",
+              "eventGridSystemTopic": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic)]",
+              "eventGridSystemTopicPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic))]",
+              "eventGridSubscription": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSubscription)]"
+            }
+          },
+          "resources": [],
+          "outputs": {
+            "resourcesNames": {
+              "type": "object",
+              "value": "[variables('resourceNames')]"
+            },
+            "resourceTypeAbbreviations": {
+              "type": "object",
+              "value": "[variables('resourceTypeAbbreviations')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64))]"
+      ],
+      "metadata": {
+        "description": "User-configured naming rules"
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('spoke-{0}-deployment', deployment().name), 64)]",
+      "location": "[deployment().location]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "spokeResourceGroupName": {
+            "value": "[variables('rgSpokeName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "environment": {
+            "value": "[parameters('environment')]"
+          },
+          "workloadName": {
+            "value": "[parameters('workloadName')]"
+          },
+          "hubVNetId": {
+            "value": "[parameters('hubVirtualNetworkResourceId')]"
+          },
+          "bastionResourceId": {
+            "value": "[parameters('bastionResourceId')]"
+          },
+          "spokeApplicationGatewaySubnetAddressPrefix": {
+            "value": "[parameters('spokeApplicationGatewaySubnetAddressPrefix')]"
+          },
+          "spokeInfraSubnetAddressPrefix": {
+            "value": "[parameters('spokeInfraSubnetAddressPrefix')]"
+          },
+          "spokePrivateEndpointsSubnetAddressPrefix": {
+            "value": "[parameters('spokePrivateEndpointsSubnetAddressPrefix')]"
+          },
+          "spokeVNetAddressPrefixes": {
+            "value": "[parameters('spokeVNetAddressPrefixes')]"
+          },
+          "networkApplianceIpAddress": {
+            "value": "[parameters('networkApplianceIpAddress')]"
+          },
+          "vmSize": {
+            "value": "[parameters('vmSize')]"
+          },
+          "vmZone": "[if(parameters('deployZoneRedundantResources'), createObject('value', 2), createObject('value', 0))]",
+          "storageAccountType": {
+            "value": "[parameters('storageAccountType')]"
+          },
+          "vmAdminUsername": {
+            "value": "[parameters('vmAdminUsername')]"
+          },
+          "vmAdminPassword": {
+            "value": "[parameters('vmAdminPassword')]"
+          },
+          "vmLinuxSshAuthorizedKey": {
+            "value": "[parameters('vmLinuxSshAuthorizedKey')]"
+          },
+          "vmJumpboxOSType": {
+            "value": "[parameters('vmJumpboxOSType')]"
+          },
+          "vmJumpBoxSubnetAddressPrefix": {
+            "value": "[parameters('vmJumpBoxSubnetAddressPrefix')]"
+          },
+          "vmAuthenticationType": {
+            "value": "[parameters('vmAuthenticationType')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "16961623286769564475"
+            }
+          },
+          "parameters": {
+            "workloadName": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 10,
+              "metadata": {
+                "description": "The name of the workload that is being deployed. Up to 10 characters long."
+              }
+            },
+            "environment": {
+              "type": "string",
+              "maxLength": 8,
+              "metadata": {
+                "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\"). Up to 8 characters long."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[deployment().location]",
+              "metadata": {
+                "description": "The location where the resources will be created. This should be the same region as the hub."
+              }
+            },
+            "spokeResourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The name of the resource group to create the resources in. If set, it overrides the name generated by the template."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The tags to be assigned to the created resources."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Whether to enable deplotment telemetry."
+              }
+            },
+            "hubVNetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing hub virtual network."
+              }
+            },
+            "bastionResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource id of the bastion host."
+              }
+            },
+            "spokeVNetAddressPrefixes": {
+              "type": "array",
+              "metadata": {
+                "description": "CIDR of the spoke virtual network. For most landing zone implementations, the spoke network would have been created by your platform team."
+              }
+            },
+            "spokeInfraSubnetName": {
+              "type": "string",
+              "defaultValue": "snet-infra",
+              "metadata": {
+                "description": "Optional. The name of the subnet to create for the spoke infrastructure. If set, it overrides the name generated by the template."
+              }
+            },
+            "spokeInfraSubnetAddressPrefix": {
+              "type": "string",
+              "metadata": {
+                "description": "CIDR of the spoke infrastructure subnet."
+              }
+            },
+            "spokePrivateEndpointsSubnetName": {
+              "type": "string",
+              "defaultValue": "snet-pep",
+              "metadata": {
+                "description": "Optional. The name of the subnet to create for the spoke private endpoints. If set, it overrides the name generated by the template."
+              }
+            },
+            "spokePrivateEndpointsSubnetAddressPrefix": {
+              "type": "string",
+              "metadata": {
+                "description": "CIDR of the spoke private endpoints subnet."
+              }
+            },
+            "spokeApplicationGatewaySubnetName": {
+              "type": "string",
+              "defaultValue": "snet-agw",
+              "metadata": {
+                "description": "Optional. The name of the subnet to create for the spoke application gateway. If set, it overrides the name generated by the template."
+              }
+            },
+            "spokeApplicationGatewaySubnetAddressPrefix": {
+              "type": "string",
+              "metadata": {
+                "description": "CIDR of the spoke Application Gateway subnet. If the value is empty, this subnet will not be created."
+              }
+            },
+            "networkApplianceIpAddress": {
+              "type": "string",
+              "metadata": {
+                "description": "The IP address of the network appliance (e.g. firewall) that will be used to route traffic to the internet."
+              }
+            },
+            "vmSize": {
+              "type": "string",
+              "metadata": {
+                "description": "The size of the jump box virtual machine to create. See https://learn.microsoft.com/azure/virtual-machines/sizes for more information."
+              }
+            },
+            "vmZone": {
+              "type": "int",
+              "defaultValue": 0,
+              "metadata": {
+                "description": "Optional. The zone to create the jump box in. Defaults to 0."
+              }
+            },
+            "storageAccountType": {
+              "type": "string",
+              "defaultValue": "Standard_LRS",
+              "metadata": {
+                "description": "Optional. The storage account type to use for the jump box. Defaults to Standard_LRS."
+              }
+            },
+            "vmAdminUsername": {
+              "type": "string",
+              "metadata": {
+                "description": "The username to use for the jump box."
+              }
+            },
+            "vmAdminPassword": {
+              "type": "securestring",
+              "metadata": {
+                "description": "The password to use for the jump box."
+              }
+            },
+            "vmLinuxSshAuthorizedKey": {
+              "type": "securestring",
+              "metadata": {
+                "description": "The SSH public key to use for the jump box. Only relevant for Linux."
+              }
+            },
+            "vmJumpboxOSType": {
+              "type": "string",
+              "defaultValue": "none",
+              "allowedValues": [
+                "linux",
+                "windows",
+                "none"
+              ],
+              "metadata": {
+                "description": "The OS of the jump box virtual machine to create. If set to \"none\", no jump box will be created."
+              }
+            },
+            "vmSubnetName": {
+              "type": "string",
+              "defaultValue": "snet-jumpbox",
+              "metadata": {
+                "description": "Optional. The name of the subnet to create for the jump box. If set, it overrides the name generated by the template."
+              }
+            },
+            "vmJumpBoxSubnetAddressPrefix": {
+              "type": "string",
+              "metadata": {
+                "description": "CIDR to use for the jump box subnet."
+              }
+            },
+            "vmAuthenticationType": {
+              "type": "string",
+              "defaultValue": "password",
+              "allowedValues": [
+                "sshPublicKey",
+                "password"
+              ],
+              "metadata": {
+                "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended."
+              }
+            }
+          },
+          "variables": {
+            "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+            "locationVar": "[if(equals(parameters('location'), 'francecentral'), 'centralfrance', parameters('location'))]",
+            "namingRules": "[json(variables('$fxv#0'))]",
+            "rgSpokeName": "[if(not(empty(parameters('spokeResourceGroupName'))), parameters('spokeResourceGroupName'), format('{0}-{1}-{2}-{3}-spoke', variables('namingRules').resourceTypeAbbreviations.resourceGroup, parameters('workloadName'), parameters('environment'), variables('namingRules').regionAbbreviations[toLower(parameters('location'))]))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('rg-{0}', deployment().name), 64)]",
+              "location": "[deployment().location]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[variables('rgSpokeName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.25.53.49325",
+                      "templateHash": "6727498516867168543"
+                    },
+                    "name": "Resource Groups",
+                    "description": "This module deploys a Resource Group.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Resource Group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[deployment().location]",
+                      "metadata": {
+                        "description": "Optional. Location of the Resource Group. It uses the deployment's location when not provided."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the storage account resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.resources-resourcegroup.{0}.{1}', replace('0.2.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "resourceGroup": {
+                      "type": "Microsoft.Resources/resourceGroups",
+                      "apiVersion": "2021-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {}
+                    },
+                    "resourceGroup_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-RG-Lock', uniqueString(deployment().name, parameters('location')))]",
+                      "resourceGroup": "[parameters('name')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          },
+                          "name": {
+                            "value": "[parameters('name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "7668050384482764751"
+                            }
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Resource Group."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "resourceGroup_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "resourceGroup"
+                      ]
+                    },
+                    "resourceGroup_roleAssignments": {
+                      "condition": "[not(empty(coalesce(parameters('roleAssignments'), createArray())))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-RG-RoleAssignments', uniqueString(deployment().name, parameters('location')))]",
+                      "resourceGroup": "[parameters('name')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "roleAssignments": {
+                            "value": "[parameters('roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "3156241559834375483"
+                            }
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Quota Request Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e5f05e5-9ab9-446b-b98d-1e2157c94125')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Resource Policy Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '36243c78-bf99-498c-9df9-86d9f8d28608')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Tag Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4a9ae827-6dc8-4573-8ac7-8239d42aa03f')]",
+                              "Template Spec Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c9b6475-caf0-4164-b5a1-2142a7116f4b')]",
+                              "Template Spec Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '392ae280-861d-42bd-9ea5-08ee6d83b80e')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "resourceGroup_roleAssignments": {
+                              "copy": {
+                                "name": "resourceGroup_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "name": "[guid(resourceGroup().id, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "resourceGroup"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the resource group."
+                      },
+                      "value": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('name'))]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('resourceGroup', '2021-04-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('spokeNamingDeployment-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "uniqueId": {
+                    "value": "[uniqueString(reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('rg-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value)]"
+                  },
+                  "environment": {
+                    "value": "[parameters('environment')]"
+                  },
+                  "workloadName": {
+                    "value": "[parameters('workloadName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "4794676376542080363"
+                    }
+                  },
+                  "parameters": {
+                    "workloadName": {
+                      "type": "string",
+                      "minLength": 2,
+                      "maxLength": 10,
+                      "metadata": {
+                        "description": "The name of the workloard that is being deployed. Up to 10 characters long."
+                      }
+                    },
+                    "environment": {
+                      "type": "string",
+                      "maxLength": 8,
+                      "metadata": {
+                        "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\") Up to 8 characters long."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location for all Resources."
+                      }
+                    },
+                    "uniqueId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness"
+                      }
+                    }
+                  },
+                  "variables": {
+                    "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+                    "naming": "[json(variables('$fxv#0'))]",
+                    "uniqueIdShort": "[substring(parameters('uniqueId'), 0, 5)]",
+                    "resourceTypeToken": "RES_TYPE",
+                    "namingBase": "[format('{0}-{1}-{2}-{3}', variables('resourceTypeToken'), parameters('workloadName'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseUnique": "[format('{0}-{1}-{2}-{3}-{4}', variables('resourceTypeToken'), parameters('workloadName'), variables('uniqueIdShort'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseNoWorkloadName": "[format('{0}-{1}-{2}', variables('resourceTypeToken'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "resourceTypeAbbreviations": "[variables('naming').resourceTypeAbbreviations]",
+                    "keyVaultName": "[take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault), 24)]",
+                    "resourceNames": {
+                      "vnetSpoke": "[format('{0}-spoke', replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "vnetHub": "[format('{0}-hub', replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "applicationGateway": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway)]",
+                      "applicationGatewayPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayUserAssignedIdentity": "[format('{0}-{1}-KeyVaultSecretUser', variables('naming').resourceTypeAbbreviations.managedIdentity, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "pepNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.privateEndpoint))]",
+                      "applicationInsights": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationInsights)]",
+                      "azureFirewall": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall)]",
+                      "azureFirewallPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall))]",
+                      "bastion": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion)]",
+                      "bastionNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "bastionPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "containerAppsEnvironment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment)]",
+                      "containerAppsEnvironmentNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment))]",
+                      "containerRegistry": "[take(toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')), 50)]",
+                      "containerRegistryPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "containerRegistryUserAssignedIdentity": "[format('{0}-{1}-AcrPull', variables('naming').resourceTypeAbbreviations.managedIdentity, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "redisCache": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache)]",
+                      "redisCachePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache))]",
+                      "openAiAccount": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cognitiveAccount)]",
+                      "openAiDeployment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.openAiDeployment)]",
+                      "cosmosDbNoSql": "[toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44))]",
+                      "cosmosDbNoSqlPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44)))]",
+                      "frontDoorProfile": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "keyVault": "[if(endsWith(variables('keyVaultName'), '-'), take(variables('keyVaultName'), 23), variables('keyVaultName'))]",
+                      "keyVaultPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault))]",
+                      "logAnalyticsWorkspace": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.logAnalyticsWorkspace)]",
+                      "routeTable": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.routeTable)]",
+                      "serviceBus": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus)]",
+                      "serviceBusPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus))]",
+                      "storageAccount": "[toLower(take(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount), '-', ''), 24))]",
+                      "storageAccountPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount)))]",
+                      "vmJumpBox": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine)]",
+                      "vmJumpBoxNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "vmJumpBoxNic": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkInterface, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "frontDoor": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "azureAISearch": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch)]",
+                      "azureAISearchPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch))]",
+                      "documentIntelligence": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence)]",
+                      "documentIntelligencePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence))]",
+                      "eventGridSystemTopic": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic)]",
+                      "eventGridSystemTopicPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic))]",
+                      "eventGridSubscription": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSubscription)]"
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourcesNames": {
+                      "type": "object",
+                      "value": "[variables('resourceNames')]"
+                    },
+                    "resourceTypeAbbreviations": {
+                      "type": "object",
+                      "value": "[variables('resourceTypeAbbreviations')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[subscriptionResourceId('Microsoft.Resources/deployments', take(format('rg-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "User-configured naming rules"
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('vnetSpoke-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vnetSpoke]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "addressPrefixes": {
+                    "value": "[parameters('spokeVNetAddressPrefixes')]"
+                  },
+                  "subnets": "[if(not(equals(parameters('vmJumpboxOSType'), 'none')), createObject('value', concat(if(not(empty(parameters('spokeApplicationGatewaySubnetAddressPrefix'))), concat(createArray(createObject('name', parameters('spokeInfraSubnetName'), 'addressPrefix', parameters('spokeInfraSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgContainerAppsEnvironment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, 'routeTableResourceId', if(and(not(empty(parameters('hubVNetId'))), not(empty(parameters('networkApplianceIpAddress')))), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('egressLockdownUdr-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, null()), 'delegations', createArray(createObject('name', 'envdelegation', 'properties', createObject('serviceName', 'Microsoft.App/environments')))), createObject('name', parameters('spokePrivateEndpointsSubnetName'), 'addressPrefix', parameters('spokePrivateEndpointsSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgPep-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value)), createArray(createObject('name', parameters('spokeApplicationGatewaySubnetName'), 'addressPrefix', parameters('spokeApplicationGatewaySubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgAppGw-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value))), createArray(createObject('name', parameters('spokeInfraSubnetName'), 'addressPrefix', parameters('spokeInfraSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgContainerAppsEnvironment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, 'routeTableResourceId', if(and(not(empty(parameters('hubVNetId'))), not(empty(parameters('networkApplianceIpAddress')))), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('egressLockdownUdr-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, null()), 'delegations', createArray(createObject('name', 'envdelegation', 'properties', createObject('serviceName', 'Microsoft.App/environments')))), createObject('name', parameters('spokePrivateEndpointsSubnetName'), 'addressPrefix', parameters('spokePrivateEndpointsSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgPep-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value))), createArray(createObject('name', parameters('vmSubnetName'), 'addressPrefix', parameters('vmJumpBoxSubnetAddressPrefix'))))), if(not(empty(parameters('spokeApplicationGatewaySubnetAddressPrefix'))), createObject('value', concat(createArray(createObject('name', parameters('spokeInfraSubnetName'), 'addressPrefix', parameters('spokeInfraSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgContainerAppsEnvironment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, 'routeTableResourceId', if(and(not(empty(parameters('hubVNetId'))), not(empty(parameters('networkApplianceIpAddress')))), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('egressLockdownUdr-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, null()), 'delegations', createArray(createObject('name', 'envdelegation', 'properties', createObject('serviceName', 'Microsoft.App/environments')))), createObject('name', parameters('spokePrivateEndpointsSubnetName'), 'addressPrefix', parameters('spokePrivateEndpointsSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgPep-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value)), createArray(createObject('name', parameters('spokeApplicationGatewaySubnetName'), 'addressPrefix', parameters('spokeApplicationGatewaySubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgAppGw-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value)))), createObject('value', createArray(createObject('name', parameters('spokeInfraSubnetName'), 'addressPrefix', parameters('spokeInfraSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgContainerAppsEnvironment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, 'routeTableResourceId', if(and(not(empty(parameters('hubVNetId'))), not(empty(parameters('networkApplianceIpAddress')))), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('egressLockdownUdr-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value, null()), 'delegations', createArray(createObject('name', 'envdelegation', 'properties', createObject('serviceName', 'Microsoft.App/environments')))), createObject('name', parameters('spokePrivateEndpointsSubnetName'), 'addressPrefix', parameters('spokePrivateEndpointsSubnetAddressPrefix'), 'networkSecurityGroupResourceId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgPep-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value)))))]",
+                  "peerings": "[if(not(empty(parameters('hubVNetId'))), createObject('value', createArray(createObject('allowForwardedTraffic', true(), 'allowGatewayTransit', false(), 'allowVirtualNetworkAccess', true(), 'remotePeeringAllowForwardedTraffic', true(), 'remotePeeringAllowVirtualNetworkAccess', true(), 'remotePeeringEnabled', true(), 'remotePeeringName', 'spokeToHub', 'remoteVirtualNetworkId', parameters('hubVNetId'), 'useRemoteGateways', false()))), createObject('value', null()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.26.170.59819",
+                      "templateHash": "18408205474040416108"
+                    },
+                    "name": "Virtual Networks",
+                    "description": "This module deploys a Virtual Network (vNet).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Virtual Network (vNet)."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "addressPrefixes": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Required. An Array of 1 or more IP Address Prefixes for the Virtual Network."
+                      }
+                    },
+                    "subnets": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. An Array of subnets to deploy to the Virtual Network."
+                      }
+                    },
+                    "dnsServers": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. DNS Servers associated to the Virtual Network."
+                      }
+                    },
+                    "ddosProtectionPlanResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Resource ID of the DDoS protection plan to assign the VNET to. If it's left blank, DDoS protection will not be configured. If it's provided, the VNET created by this template will be attached to the referenced DDoS protection plan. The DDoS protection plan can exist in the same or in a different subscription."
+                      }
+                    },
+                    "peerings": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Virtual Network Peerings configurations."
+                      }
+                    },
+                    "vnetEncryption": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates if encryption is enabled on virtual network and if VM without encryption is allowed in encrypted VNet. Requires the EnableVNetEncryption feature to be registered for the subscription and a supported region to use this property."
+                      }
+                    },
+                    "vnetEncryptionEnforcement": {
+                      "type": "string",
+                      "defaultValue": "AllowUnencrypted",
+                      "allowedValues": [
+                        "AllowUnencrypted",
+                        "DropUnencrypted"
+                      ],
+                      "metadata": {
+                        "description": "Optional. If the encrypted VNet allows VM that does not support encryption. Can only be used when vnetEncryption is enabled."
+                      }
+                    },
+                    "flowTimeoutInMinutes": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "maxValue": 30,
+                      "metadata": {
+                        "description": "Optional. The flow timeout in minutes for the Virtual Network, which is used to enable connection tracking for intra-VM flows. Possible values are between 4 and 30 minutes. Default value 0 will set the property to null."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-virtualnetwork.{0}.{1}', replace('0.1.6', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "virtualNetwork": {
+                      "type": "Microsoft.Network/virtualNetworks",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "subnets",
+                            "count": "[length(parameters('subnets'))]",
+                            "input": {
+                              "name": "[parameters('subnets')[copyIndex('subnets')].name]",
+                              "properties": {
+                                "addressPrefix": "[parameters('subnets')[copyIndex('subnets')].addressPrefix]",
+                                "addressPrefixes": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'addressPrefixes'), parameters('subnets')[copyIndex('subnets')].addressPrefixes, createArray())]",
+                                "applicationGatewayIPConfigurations": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'applicationGatewayIPConfigurations'), parameters('subnets')[copyIndex('subnets')].applicationGatewayIPConfigurations, createArray())]",
+                                "delegations": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'delegations'), parameters('subnets')[copyIndex('subnets')].delegations, createArray())]",
+                                "ipAllocations": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'ipAllocations'), parameters('subnets')[copyIndex('subnets')].ipAllocations, createArray())]",
+                                "natGateway": "[if(and(contains(parameters('subnets')[copyIndex('subnets')], 'natGatewayResourceId'), not(empty(parameters('subnets')[copyIndex('subnets')].natGatewayResourceId))), createObject('id', parameters('subnets')[copyIndex('subnets')].natGatewayResourceId), null())]",
+                                "networkSecurityGroup": "[if(and(contains(parameters('subnets')[copyIndex('subnets')], 'networkSecurityGroupResourceId'), not(empty(parameters('subnets')[copyIndex('subnets')].networkSecurityGroupResourceId))), createObject('id', parameters('subnets')[copyIndex('subnets')].networkSecurityGroupResourceId), null())]",
+                                "privateEndpointNetworkPolicies": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'privateEndpointNetworkPolicies'), parameters('subnets')[copyIndex('subnets')].privateEndpointNetworkPolicies, null())]",
+                                "privateLinkServiceNetworkPolicies": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'privateLinkServiceNetworkPolicies'), parameters('subnets')[copyIndex('subnets')].privateLinkServiceNetworkPolicies, null())]",
+                                "routeTable": "[if(and(contains(parameters('subnets')[copyIndex('subnets')], 'routeTableResourceId'), not(empty(parameters('subnets')[copyIndex('subnets')].routeTableResourceId))), createObject('id', parameters('subnets')[copyIndex('subnets')].routeTableResourceId), null())]",
+                                "serviceEndpoints": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'serviceEndpoints'), parameters('subnets')[copyIndex('subnets')].serviceEndpoints, createArray())]",
+                                "serviceEndpointPolicies": "[if(contains(parameters('subnets')[copyIndex('subnets')], 'serviceEndpointPolicies'), parameters('subnets')[copyIndex('subnets')].serviceEndpointPolicies, createArray())]"
+                              }
+                            }
+                          }
+                        ],
+                        "addressSpace": {
+                          "addressPrefixes": "[parameters('addressPrefixes')]"
+                        },
+                        "ddosProtectionPlan": "[if(not(empty(parameters('ddosProtectionPlanResourceId'))), createObject('id', parameters('ddosProtectionPlanResourceId')), null())]",
+                        "dhcpOptions": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', array(parameters('dnsServers'))), null())]",
+                        "enableDdosProtection": "[not(empty(parameters('ddosProtectionPlanResourceId')))]",
+                        "encryption": "[if(equals(parameters('vnetEncryption'), true()), createObject('enabled', parameters('vnetEncryption'), 'enforcement', parameters('vnetEncryptionEnforcement')), null())]",
+                        "flowTimeoutInMinutes": "[if(not(equals(parameters('flowTimeoutInMinutes'), 0)), parameters('flowTimeoutInMinutes'), null())]"
+                      }
+                    },
+                    "virtualNetwork_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_diagnosticSettings": {
+                      "copy": {
+                        "name": "virtualNetwork_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_roleAssignments": {
+                      "copy": {
+                        "name": "virtualNetwork_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_subnets": {
+                      "copy": {
+                        "name": "virtualNetwork_subnets",
+                        "count": "[length(parameters('subnets'))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-subnet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualNetworkName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('subnets')[copyIndex()].name]"
+                          },
+                          "addressPrefix": {
+                            "value": "[parameters('subnets')[copyIndex()].addressPrefix]"
+                          },
+                          "addressPrefixes": "[if(contains(parameters('subnets')[copyIndex()], 'addressPrefixes'), createObject('value', parameters('subnets')[copyIndex()].addressPrefixes), createObject('value', createArray()))]",
+                          "applicationGatewayIPConfigurations": "[if(contains(parameters('subnets')[copyIndex()], 'applicationGatewayIPConfigurations'), createObject('value', parameters('subnets')[copyIndex()].applicationGatewayIPConfigurations), createObject('value', createArray()))]",
+                          "delegations": "[if(contains(parameters('subnets')[copyIndex()], 'delegations'), createObject('value', parameters('subnets')[copyIndex()].delegations), createObject('value', createArray()))]",
+                          "ipAllocations": "[if(contains(parameters('subnets')[copyIndex()], 'ipAllocations'), createObject('value', parameters('subnets')[copyIndex()].ipAllocations), createObject('value', createArray()))]",
+                          "natGatewayResourceId": "[if(contains(parameters('subnets')[copyIndex()], 'natGatewayResourceId'), createObject('value', parameters('subnets')[copyIndex()].natGatewayResourceId), createObject('value', ''))]",
+                          "networkSecurityGroupResourceId": "[if(contains(parameters('subnets')[copyIndex()], 'networkSecurityGroupResourceId'), createObject('value', parameters('subnets')[copyIndex()].networkSecurityGroupResourceId), createObject('value', ''))]",
+                          "privateEndpointNetworkPolicies": "[if(contains(parameters('subnets')[copyIndex()], 'privateEndpointNetworkPolicies'), createObject('value', parameters('subnets')[copyIndex()].privateEndpointNetworkPolicies), createObject('value', ''))]",
+                          "privateLinkServiceNetworkPolicies": "[if(contains(parameters('subnets')[copyIndex()], 'privateLinkServiceNetworkPolicies'), createObject('value', parameters('subnets')[copyIndex()].privateLinkServiceNetworkPolicies), createObject('value', ''))]",
+                          "roleAssignments": "[if(contains(parameters('subnets')[copyIndex()], 'roleAssignments'), createObject('value', parameters('subnets')[copyIndex()].roleAssignments), createObject('value', createArray()))]",
+                          "routeTableResourceId": "[if(contains(parameters('subnets')[copyIndex()], 'routeTableResourceId'), createObject('value', parameters('subnets')[copyIndex()].routeTableResourceId), createObject('value', ''))]",
+                          "serviceEndpointPolicies": "[if(contains(parameters('subnets')[copyIndex()], 'serviceEndpointPolicies'), createObject('value', parameters('subnets')[copyIndex()].serviceEndpointPolicies), createObject('value', createArray()))]",
+                          "serviceEndpoints": "[if(contains(parameters('subnets')[copyIndex()], 'serviceEndpoints'), createObject('value', parameters('subnets')[copyIndex()].serviceEndpoints), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.26.170.59819",
+                              "templateHash": "17306638026226376877"
+                            },
+                            "name": "Virtual Network Subnets",
+                            "description": "This module deploys a Virtual Network Subnet.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Optional. The Name of the subnet resource."
+                              }
+                            },
+                            "virtualNetworkName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual network. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "addressPrefix": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The address prefix for the subnet."
+                              }
+                            },
+                            "networkSecurityGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                              }
+                            },
+                            "routeTableResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource ID of the route table to assign to the subnet."
+                              }
+                            },
+                            "serviceEndpoints": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The service endpoints to enable on the subnet."
+                              }
+                            },
+                            "delegations": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The delegations to enable on the subnet."
+                              }
+                            },
+                            "natGatewayResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                              }
+                            },
+                            "privateEndpointNetworkPolicies": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
+                              }
+                            },
+                            "privateLinkServiceNetworkPolicies": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. enable or disable apply network policies on private link service in the subnet."
+                              }
+                            },
+                            "addressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of address prefixes for the subnet."
+                              }
+                            },
+                            "applicationGatewayIPConfigurations": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Application gateway IP configurations of virtual network resource."
+                              }
+                            },
+                            "ipAllocations": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Array of IpAllocation which reference this subnet."
+                              }
+                            },
+                            "serviceEndpointPolicies": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of service endpoint policies."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "virtualNetwork": {
+                              "existing": true,
+                              "type": "Microsoft.Network/virtualNetworks",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('virtualNetworkName')]"
+                            },
+                            "subnet": {
+                              "type": "Microsoft.Network/virtualNetworks/subnets",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('name'))]",
+                              "properties": {
+                                "addressPrefix": "[parameters('addressPrefix')]",
+                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]",
+                                "routeTable": "[if(not(empty(parameters('routeTableResourceId'))), createObject('id', parameters('routeTableResourceId')), null())]",
+                                "natGateway": "[if(not(empty(parameters('natGatewayResourceId'))), createObject('id', parameters('natGatewayResourceId')), null())]",
+                                "serviceEndpoints": "[parameters('serviceEndpoints')]",
+                                "delegations": "[parameters('delegations')]",
+                                "privateEndpointNetworkPolicies": "[if(not(empty(parameters('privateEndpointNetworkPolicies'))), parameters('privateEndpointNetworkPolicies'), null())]",
+                                "privateLinkServiceNetworkPolicies": "[if(not(empty(parameters('privateLinkServiceNetworkPolicies'))), parameters('privateLinkServiceNetworkPolicies'), null())]",
+                                "addressPrefixes": "[parameters('addressPrefixes')]",
+                                "applicationGatewayIPConfigurations": "[parameters('applicationGatewayIPConfigurations')]",
+                                "ipAllocations": "[parameters('ipAllocations')]",
+                                "serviceEndpointPolicies": "[parameters('serviceEndpointPolicies')]"
+                              },
+                              "dependsOn": [
+                                "virtualNetwork"
+                              ]
+                            },
+                            "subnet_roleAssignments": {
+                              "copy": {
+                                "name": "subnet_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/virtualNetworks/{0}/subnets/{1}', parameters('virtualNetworkName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "subnet"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network peering was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network peering."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network peering."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]"
+                            },
+                            "subnetAddressPrefix": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The address prefix for the subnet."
+                              },
+                              "value": "[reference('subnet').addressPrefix]"
+                            },
+                            "subnetAddressPrefixes": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "List of address prefixes for the subnet."
+                              },
+                              "value": "[if(not(empty(parameters('addressPrefixes'))), reference('subnet').addressPrefixes, createArray())]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_peering_local": {
+                      "copy": {
+                        "name": "virtualNetwork_peering_local",
+                        "count": "[length(parameters('peerings'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-virtualNetworkPeering-local-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "localVnetName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "remoteVirtualNetworkId": {
+                            "value": "[parameters('peerings')[copyIndex()].remoteVirtualNetworkId]"
+                          },
+                          "name": "[if(contains(parameters('peerings')[copyIndex()], 'name'), createObject('value', parameters('peerings')[copyIndex()].name), createObject('value', format('{0}-{1}', parameters('name'), last(split(parameters('peerings')[copyIndex()].remoteVirtualNetworkId, '/')))))]",
+                          "allowForwardedTraffic": "[if(contains(parameters('peerings')[copyIndex()], 'allowForwardedTraffic'), createObject('value', parameters('peerings')[copyIndex()].allowForwardedTraffic), createObject('value', true()))]",
+                          "allowGatewayTransit": "[if(contains(parameters('peerings')[copyIndex()], 'allowGatewayTransit'), createObject('value', parameters('peerings')[copyIndex()].allowGatewayTransit), createObject('value', false()))]",
+                          "allowVirtualNetworkAccess": "[if(contains(parameters('peerings')[copyIndex()], 'allowVirtualNetworkAccess'), createObject('value', parameters('peerings')[copyIndex()].allowVirtualNetworkAccess), createObject('value', true()))]",
+                          "doNotVerifyRemoteGateways": "[if(contains(parameters('peerings')[copyIndex()], 'doNotVerifyRemoteGateways'), createObject('value', parameters('peerings')[copyIndex()].doNotVerifyRemoteGateways), createObject('value', true()))]",
+                          "useRemoteGateways": "[if(contains(parameters('peerings')[copyIndex()], 'useRemoteGateways'), createObject('value', parameters('peerings')[copyIndex()].useRemoteGateways), createObject('value', false()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.26.170.59819",
+                              "templateHash": "17624189975510507274"
+                            },
+                            "name": "Virtual Network Peerings",
+                            "description": "This module deploys a Virtual Network Peering.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The Name of Vnet Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                              }
+                            },
+                            "localVnetName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "remoteVirtualNetworkId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                              }
+                            },
+                            "allowForwardedTraffic": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                              }
+                            },
+                            "allowGatewayTransit": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                              }
+                            },
+                            "allowVirtualNetworkAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                              }
+                            },
+                            "doNotVerifyRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                              }
+                            },
+                            "useRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                              "properties": {
+                                "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                                "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                                "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                                "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                                "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                                "remoteVirtualNetwork": {
+                                  "id": "[parameters('remoteVirtualNetworkId')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network peering was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network peering."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network peering."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_peering_remote": {
+                      "copy": {
+                        "name": "virtualNetwork_peering_remote",
+                        "count": "[length(parameters('peerings'))]"
+                      },
+                      "condition": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringEnabled'), equals(parameters('peerings')[copyIndex()].remotePeeringEnabled, true()), false())]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-virtualNetworkPeering-remote-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(parameters('peerings')[copyIndex()].remoteVirtualNetworkId, '/')[2]]",
+                      "resourceGroup": "[split(parameters('peerings')[copyIndex()].remoteVirtualNetworkId, '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "localVnetName": {
+                            "value": "[last(split(parameters('peerings')[copyIndex()].remoteVirtualNetworkId, '/'))]"
+                          },
+                          "remoteVirtualNetworkId": {
+                            "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                          },
+                          "name": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringName'), createObject('value', parameters('peerings')[copyIndex()].remotePeeringName), createObject('value', format('{0}-{1}', last(split(parameters('peerings')[copyIndex()].remoteVirtualNetworkId, '/')), parameters('name'))))]",
+                          "allowForwardedTraffic": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringAllowForwardedTraffic'), createObject('value', parameters('peerings')[copyIndex()].remotePeeringAllowForwardedTraffic), createObject('value', true()))]",
+                          "allowGatewayTransit": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringAllowGatewayTransit'), createObject('value', parameters('peerings')[copyIndex()].remotePeeringAllowGatewayTransit), createObject('value', false()))]",
+                          "allowVirtualNetworkAccess": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringAllowVirtualNetworkAccess'), createObject('value', parameters('peerings')[copyIndex()].remotePeeringAllowVirtualNetworkAccess), createObject('value', true()))]",
+                          "doNotVerifyRemoteGateways": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringDoNotVerifyRemoteGateways'), createObject('value', parameters('peerings')[copyIndex()].remotePeeringDoNotVerifyRemoteGateways), createObject('value', true()))]",
+                          "useRemoteGateways": "[if(contains(parameters('peerings')[copyIndex()], 'remotePeeringUseRemoteGateways'), createObject('value', parameters('peerings')[copyIndex()].remotePeeringUseRemoteGateways), createObject('value', false()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.26.170.59819",
+                              "templateHash": "17624189975510507274"
+                            },
+                            "name": "Virtual Network Peerings",
+                            "description": "This module deploys a Virtual Network Peering.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The Name of Vnet Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                              }
+                            },
+                            "localVnetName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "remoteVirtualNetworkId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                              }
+                            },
+                            "allowForwardedTraffic": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                              }
+                            },
+                            "allowGatewayTransit": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                              }
+                            },
+                            "allowVirtualNetworkAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                              }
+                            },
+                            "doNotVerifyRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                              }
+                            },
+                            "useRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                              "properties": {
+                                "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                                "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                                "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                                "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                                "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                                "remoteVirtualNetwork": {
+                                  "id": "[parameters('remoteVirtualNetworkId')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network peering was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network peering."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network peering."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the virtual network was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the virtual network."
+                      },
+                      "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the virtual network."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "subnetNames": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The names of the deployed subnets."
+                      },
+                      "copy": {
+                        "count": "[length(parameters('subnets'))]",
+                        "input": "[parameters('subnets')[copyIndex()].name]"
+                      }
+                    },
+                    "subnetResourceIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The resource IDs of the deployed subnets."
+                      },
+                      "copy": {
+                        "count": "[length(parameters('subnets'))]",
+                        "input": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('name'), parameters('subnets')[copyIndex()].name)]"
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('virtualNetwork', '2023-04-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('egressLockdownUdr-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgAppGw-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgContainerAppsEnvironment-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('nsgPep-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "The spoke virtual network in which the workload will run from. This virtual network would normally already be provisioned by your subscription vending process, and only the subnets would need to be configured."
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('logAnalyticsWs-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.logAnalyticsWorkspace]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.25.53.49325",
+                      "templateHash": "6354173151975740736"
+                    },
+                    "name": "Log Analytics Workspaces",
+                    "description": "This module deploys a Log Analytics Workspace.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "managedIdentitiesType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Log Analytics workspace."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "PerGB2018",
+                      "allowedValues": [
+                        "CapacityReservation",
+                        "Free",
+                        "LACluster",
+                        "PerGB2018",
+                        "PerNode",
+                        "Premium",
+                        "Standalone",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The name of the SKU."
+                      }
+                    },
+                    "skuCapacityReservationLevel": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "minValue": 100,
+                      "maxValue": 5000,
+                      "metadata": {
+                        "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
+                      }
+                    },
+                    "storageInsightsConfigs": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. List of storage accounts to be read by the workspace."
+                      }
+                    },
+                    "linkedServices": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. List of services to be linked."
+                      }
+                    },
+                    "linkedStorageAccounts": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
+                      }
+                    },
+                    "savedSearches": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Kusto Query Language searches to save."
+                      }
+                    },
+                    "dataExports": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. LAW data export instances to be deployed."
+                      }
+                    },
+                    "dataSources": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. LAW data sources to configure."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. LAW custom tables to be deployed."
+                      }
+                    },
+                    "gallerySolutions": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
+                      }
+                    },
+                    "dataRetention": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "minValue": 0,
+                      "maxValue": 730,
+                      "metadata": {
+                        "description": "Optional. Number of days data will be retained for."
+                      }
+                    },
+                    "dailyQuotaGb": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "minValue": -1,
+                      "metadata": {
+                        "description": "Optional. The workspace daily quota for ingestion."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Log Analytics ingestion."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Log Analytics query."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentitiesType",
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
+                      }
+                    },
+                    "useResourcePermissions": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Set to 'true' to use resource or workspace permissions and 'false' (or leave empty) to require workspace permissions."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "forceCmkForQuery": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
+                      "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.3.4', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "logAnalyticsWorkspace": {
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2022-10-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "features": {
+                          "searchVersion": 1,
+                          "enableLogAccessUsingOnlyResourcePermissions": "[parameters('useResourcePermissions')]"
+                        },
+                        "sku": {
+                          "name": "[parameters('skuName')]",
+                          "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
+                        },
+                        "retentionInDays": "[parameters('dataRetention')]",
+                        "workspaceCapping": {
+                          "dailyQuotaGb": "[parameters('dailyQuotaGb')]"
+                        },
+                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                        "forceCmkForQuery": "[parameters('forceCmkForQuery')]"
+                      },
+                      "identity": "[variables('identity')]"
+                    },
+                    "logAnalyticsWorkspace_diagnosticSettings": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_roleAssignments": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_storageInsightConfigs": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_storageInsightConfigs",
+                        "count": "[length(parameters('storageInsightsConfigs'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "containers": "[if(contains(parameters('storageInsightsConfigs')[copyIndex()], 'containers'), createObject('value', parameters('storageInsightsConfigs')[copyIndex()].containers), createObject('value', createArray()))]",
+                          "tables": "[if(contains(parameters('storageInsightsConfigs')[copyIndex()], 'tables'), createObject('value', parameters('storageInsightsConfigs')[copyIndex()].tables), createObject('value', createArray()))]",
+                          "storageAccountResourceId": {
+                            "value": "[parameters('storageInsightsConfigs')[copyIndex()].storageAccountResourceId]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "4862843187650272248"
+                            },
+                            "name": "Log Analytics Workspace Storage Insight Configs",
+                            "description": "This module deploys a Log Analytics Workspace Storage Insight Config.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The name of the storage insights config."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Azure Resource Manager ID of the storage account resource."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The names of the blob containers that the workspace should read."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The names of the Azure tables that the workspace should read."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to configure in the resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2022-09-01",
+                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                            },
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2022-10-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "storageinsightconfig": {
+                              "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
+                              "apiVersion": "2020-08-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "containers": "[parameters('containers')]",
+                                "tables": "[parameters('tables')]",
+                                "storageAccount": {
+                                  "id": "[parameters('storageAccountResourceId')]",
+                                  "key": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), '2022-09-01').keys[0].value]"
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount",
+                                "workspace"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed storage insights configuration."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the storage insight configuration is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the storage insights configuration."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_linkedServices": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_linkedServices",
+                        "count": "[length(parameters('linkedServices'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('linkedServices')[copyIndex()].name]"
+                          },
+                          "resourceId": "[if(contains(parameters('linkedServices')[copyIndex()], 'resourceId'), createObject('value', parameters('linkedServices')[copyIndex()].resourceId), createObject('value', ''))]",
+                          "writeAccessResourceId": "[if(contains(parameters('linkedServices')[copyIndex()], 'writeAccessResourceId'), createObject('value', parameters('linkedServices')[copyIndex()].writeAccessResourceId), createObject('value', ''))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "14301767156435143002"
+                            },
+                            "name": "Log Analytics Workspace Linked Services",
+                            "description": "This module deploys a Log Analytics Workspace Linked Service.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the link."
+                              }
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Required. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                              }
+                            },
+                            "writeAccessResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to configure in the resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2022-10-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "linkedService": {
+                              "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
+                              "apiVersion": "2020-08-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resourceId": "[parameters('resourceId')]",
+                                "writeAccessResourceId": "[if(empty(parameters('writeAccessResourceId')), null(), parameters('writeAccessResourceId'))]"
+                              },
+                              "dependsOn": [
+                                "workspace"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed linked service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed linked service."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the linked service is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_linkedStorageAccounts": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_linkedStorageAccounts",
+                        "count": "[length(parameters('linkedStorageAccounts'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('linkedStorageAccounts')[copyIndex()].name]"
+                          },
+                          "resourceId": {
+                            "value": "[parameters('linkedStorageAccounts')[copyIndex()].resourceId]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "6713282874166856483"
+                            },
+                            "name": "Log Analytics Workspace Linked Storage Accounts",
+                            "description": "This module deploys a Log Analytics Workspace Linked Storage Account.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Query",
+                                "Alerts",
+                                "CustomLogs",
+                                "AzureWatson"
+                              ],
+                              "metadata": {
+                                "description": "Required. Name of the link."
+                              }
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
+                              "apiVersion": "2020-08-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "properties": {
+                                "storageAccountIds": [
+                                  "[parameters('resourceId')]"
+                                ]
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed linked storage account."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed linked storage account."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the linked storage account is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_savedSearches": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_savedSearches",
+                        "count": "[length(parameters('savedSearches'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[format('{0}{1}', parameters('savedSearches')[copyIndex()].name, uniqueString(deployment().name))]"
+                          },
+                          "etag": {
+                            "value": "[tryGet(parameters('savedSearches')[copyIndex()], 'etag')]"
+                          },
+                          "displayName": {
+                            "value": "[parameters('savedSearches')[copyIndex()].displayName]"
+                          },
+                          "category": {
+                            "value": "[parameters('savedSearches')[copyIndex()].category]"
+                          },
+                          "query": {
+                            "value": "[parameters('savedSearches')[copyIndex()].query]"
+                          },
+                          "functionAlias": {
+                            "value": "[tryGet(parameters('savedSearches')[copyIndex()], 'functionAlias')]"
+                          },
+                          "functionParameters": {
+                            "value": "[tryGet(parameters('savedSearches')[copyIndex()], 'functionParameters')]"
+                          },
+                          "version": {
+                            "value": "[tryGet(parameters('savedSearches')[copyIndex()], 'version')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "17950009471823327560"
+                            },
+                            "name": "Log Analytics Workspace Saved Searches",
+                            "description": "This module deploys a Log Analytics Workspace Saved Search.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the saved search."
+                              }
+                            },
+                            "displayName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Display name for the search."
+                              }
+                            },
+                            "category": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Query category."
+                              }
+                            },
+                            "query": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Kusto Query to be stored."
+                              }
+                            },
+                            "tags": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to configure in the resource."
+                              }
+                            },
+                            "functionAlias": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The function alias if query serves as a function."
+                              }
+                            },
+                            "functionParameters": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                              }
+                            },
+                            "version": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The version number of the query language."
+                              }
+                            },
+                            "etag": {
+                              "type": "string",
+                              "defaultValue": "*",
+                              "metadata": {
+                                "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2022-10-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "savedSearch": {
+                              "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+                              "apiVersion": "2020-08-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "properties": {
+                                "etag": "[parameters('etag')]",
+                                "tags": "[coalesce(parameters('tags'), createArray())]",
+                                "displayName": "[parameters('displayName')]",
+                                "category": "[parameters('category')]",
+                                "query": "[parameters('query')]",
+                                "functionAlias": "[parameters('functionAlias')]",
+                                "functionParameters": "[parameters('functionParameters')]",
+                                "version": "[parameters('version')]"
+                              },
+                              "dependsOn": [
+                                "workspace"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed saved search."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the saved search is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed saved search."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace",
+                        "logAnalyticsWorkspace_linkedStorageAccounts"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_dataExports": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_dataExports",
+                        "count": "[length(parameters('dataExports'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "workspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('dataExports')[copyIndex()].name]"
+                          },
+                          "destination": "[if(contains(parameters('dataExports')[copyIndex()], 'destination'), createObject('value', parameters('dataExports')[copyIndex()].destination), createObject('value', createObject()))]",
+                          "enable": "[if(contains(parameters('dataExports')[copyIndex()], 'enable'), createObject('value', parameters('dataExports')[copyIndex()].enable), createObject('value', false()))]",
+                          "tableNames": "[if(contains(parameters('dataExports')[copyIndex()], 'tableNames'), createObject('value', parameters('dataExports')[copyIndex()].tableNames), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "12543023571728523937"
+                            },
+                            "name": "Log Analytics Workspace Data Exports",
+                            "description": "This module deploys a Log Analytics Workspace Data Export.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 4,
+                              "maxLength": 63,
+                              "metadata": {
+                                "description": "Required. The data export rule name."
+                              }
+                            },
+                            "workspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "destination": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Destination properties."
+                              }
+                            },
+                            "enable": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Active when enabled."
+                              }
+                            },
+                            "tableNames": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.OperationalInsights/workspaces/dataExports",
+                              "apiVersion": "2020-08-01",
+                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "properties": {
+                                "destination": "[parameters('destination')]",
+                                "enable": "[parameters('enable')]",
+                                "tableNames": "[parameters('tableNames')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the data export."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the data export."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the data export was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_dataSources": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_dataSources",
+                        "count": "[length(parameters('dataSources'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('dataSources')[copyIndex()].name]"
+                          },
+                          "kind": {
+                            "value": "[parameters('dataSources')[copyIndex()].kind]"
+                          },
+                          "linkedResourceId": "[if(contains(parameters('dataSources')[copyIndex()], 'linkedResourceId'), createObject('value', parameters('dataSources')[copyIndex()].linkedResourceId), createObject('value', ''))]",
+                          "eventLogName": "[if(contains(parameters('dataSources')[copyIndex()], 'eventLogName'), createObject('value', parameters('dataSources')[copyIndex()].eventLogName), createObject('value', ''))]",
+                          "eventTypes": "[if(contains(parameters('dataSources')[copyIndex()], 'eventTypes'), createObject('value', parameters('dataSources')[copyIndex()].eventTypes), createObject('value', createArray()))]",
+                          "objectName": "[if(contains(parameters('dataSources')[copyIndex()], 'objectName'), createObject('value', parameters('dataSources')[copyIndex()].objectName), createObject('value', ''))]",
+                          "instanceName": "[if(contains(parameters('dataSources')[copyIndex()], 'instanceName'), createObject('value', parameters('dataSources')[copyIndex()].instanceName), createObject('value', ''))]",
+                          "intervalSeconds": "[if(contains(parameters('dataSources')[copyIndex()], 'intervalSeconds'), createObject('value', parameters('dataSources')[copyIndex()].intervalSeconds), createObject('value', 60))]",
+                          "counterName": "[if(contains(parameters('dataSources')[copyIndex()], 'counterName'), createObject('value', parameters('dataSources')[copyIndex()].counterName), createObject('value', ''))]",
+                          "state": "[if(contains(parameters('dataSources')[copyIndex()], 'state'), createObject('value', parameters('dataSources')[copyIndex()].state), createObject('value', ''))]",
+                          "syslogName": "[if(contains(parameters('dataSources')[copyIndex()], 'syslogName'), createObject('value', parameters('dataSources')[copyIndex()].syslogName), createObject('value', ''))]",
+                          "syslogSeverities": "[if(contains(parameters('dataSources')[copyIndex()], 'syslogSeverities'), createObject('value', parameters('dataSources')[copyIndex()].syslogSeverities), createObject('value', createArray()))]",
+                          "performanceCounters": "[if(contains(parameters('dataSources')[copyIndex()], 'performanceCounters'), createObject('value', parameters('dataSources')[copyIndex()].performanceCounters), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "14032975851567807564"
+                            },
+                            "name": "Log Analytics Workspace Datasources",
+                            "description": "This module deploys a Log Analytics Workspace Data Source.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the solution."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "AzureActivityLog",
+                              "allowedValues": [
+                                "AzureActivityLog",
+                                "WindowsEvent",
+                                "WindowsPerformanceCounter",
+                                "IISLogs",
+                                "LinuxSyslog",
+                                "LinuxSyslogCollection",
+                                "LinuxPerformanceObject",
+                                "LinuxPerformanceCollection"
+                              ],
+                              "metadata": {
+                                "description": "Required. The kind of the DataSource."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to configure in the resource."
+                              }
+                            },
+                            "linkedResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of the resource to be linked."
+                              }
+                            },
+                            "eventLogName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
+                              }
+                            },
+                            "eventTypes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Windows event types to configure when kind is WindowsEvent."
+                              }
+                            },
+                            "objectName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "instanceName": {
+                              "type": "string",
+                              "defaultValue": "*",
+                              "metadata": {
+                                "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "intervalSeconds": {
+                              "type": "int",
+                              "defaultValue": 60,
+                              "metadata": {
+                                "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "performanceCounters": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                              }
+                            },
+                            "counterName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                              }
+                            },
+                            "state": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                              }
+                            },
+                            "syslogName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. System log to configure when kind is LinuxSyslog."
+                              }
+                            },
+                            "syslogSeverities": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2022-10-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "dataSource": {
+                              "type": "Microsoft.OperationalInsights/workspaces/dataSources",
+                              "apiVersion": "2020-08-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
+                                "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
+                                "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
+                                "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
+                                "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
+                                "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
+                                "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
+                                "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
+                                "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
+                                "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
+                                "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
+                              },
+                              "dependsOn": [
+                                "workspace"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed data source."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the data source is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed data source."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_tables": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_tables",
+                        "count": "[length(parameters('tables'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "workspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('tables')[copyIndex()].name]"
+                          },
+                          "plan": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'plan')]"
+                          },
+                          "schema": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'schema')]"
+                          },
+                          "retentionInDays": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'retentionInDays')]"
+                          },
+                          "totalRetentionInDays": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'totalRetentionInDays')]"
+                          },
+                          "restoredLogs": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'restoredLogs')]"
+                          },
+                          "searchResults": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'searchResults')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "4932423807790181892"
+                            },
+                            "name": "Log Analytics Workspace Tables",
+                            "description": "This module deploys a Log Analytics Workspace Table.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the table."
+                              }
+                            },
+                            "workspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "plan": {
+                              "type": "string",
+                              "defaultValue": "Analytics",
+                              "allowedValues": [
+                                "Basic",
+                                "Analytics"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
+                              }
+                            },
+                            "restoredLogs": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Restore parameters."
+                              }
+                            },
+                            "retentionInDays": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "minValue": -1,
+                              "maxValue": 730,
+                              "metadata": {
+                                "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention."
+                              }
+                            },
+                            "schema": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Table's schema."
+                              }
+                            },
+                            "searchResults": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Parameters of the search job that initiated this table."
+                              }
+                            },
+                            "totalRetentionInDays": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "minValue": -1,
+                              "maxValue": 2555,
+                              "metadata": {
+                                "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2022-10-01",
+                              "name": "[parameters('workspaceName')]"
+                            },
+                            "table": {
+                              "type": "Microsoft.OperationalInsights/workspaces/tables",
+                              "apiVersion": "2022-10-01",
+                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "properties": {
+                                "plan": "[parameters('plan')]",
+                                "restoredLogs": "[parameters('restoredLogs')]",
+                                "retentionInDays": "[parameters('retentionInDays')]",
+                                "schema": "[parameters('schema')]",
+                                "searchResults": "[parameters('searchResults')]",
+                                "totalRetentionInDays": "[parameters('totalRetentionInDays')]"
+                              },
+                              "dependsOn": [
+                                "workspace"
+                              ]
+                            },
+                            "table_roleAssignments": {
+                              "copy": {
+                                "name": "table_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "table"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the table."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the table."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the table was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_solutions": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_solutions",
+                        "count": "[length(parameters('gallerySolutions'))]"
+                      },
+                      "condition": "[not(empty(parameters('gallerySolutions')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('gallerySolutions')[copyIndex()].name]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "product": "[if(contains(parameters('gallerySolutions')[copyIndex()], 'product'), createObject('value', parameters('gallerySolutions')[copyIndex()].product), createObject('value', 'OMSGallery'))]",
+                          "publisher": "[if(contains(parameters('gallerySolutions')[copyIndex()], 'publisher'), createObject('value', parameters('gallerySolutions')[copyIndex()].publisher), createObject('value', 'Microsoft'))]",
+                          "enableTelemetry": {
+                            "value": "[coalesce(tryGet(parameters('gallerySolutions')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.23.1.45101",
+                              "templateHash": "18444780972506374592"
+                            },
+                            "name": "Operations Management Solutions",
+                            "description": "This module deploys an Operations Management Solution.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the solution. For Microsoft published gallery solution the target solution resource name will be composed as `{name}({logAnalyticsWorkspaceName})`."
+                              }
+                            },
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "product": {
+                              "type": "string",
+                              "defaultValue": "OMSGallery",
+                              "metadata": {
+                                "description": "Optional. The product of the deployed solution. For Microsoft published gallery solution it should be `OMSGallery` and the target solution resource product will be composed as `OMSGallery/{name}`. For third party solution, it can be anything. This is case sensitive."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "defaultValue": "Microsoft",
+                              "metadata": {
+                                "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "solutionName": "[if(equals(parameters('publisher'), 'Microsoft'), format('{0}({1})', parameters('name'), parameters('logAnalyticsWorkspaceName')), parameters('name'))]",
+                            "solutionProduct": "[if(equals(parameters('publisher'), 'Microsoft'), format('OMSGallery/{0}', parameters('name')), parameters('product'))]"
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.OperationsManagement/solutions",
+                              "apiVersion": "2015-11-01-preview",
+                              "name": "[variables('solutionName')]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
+                              },
+                              "plan": {
+                                "name": "[variables('solutionName')]",
+                                "promotionCode": "",
+                                "product": "[variables('solutionProduct')]",
+                                "publisher": "[parameters('publisher')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed solution."
+                              },
+                              "value": "[variables('solutionName')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed solution."
+                              },
+                              "value": "[resourceId('Microsoft.OperationsManagement/solutions', variables('solutionName'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the solution is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference(resourceId('Microsoft.OperationsManagement/solutions', variables('solutionName')), '2015-11-01-preview', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed log analytics workspace."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed log analytics workspace."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed log analytics workspace."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "logAnalyticsWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The ID associated with the workspace."
+                      },
+                      "value": "[reference('logAnalyticsWorkspace').customerId]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('logAnalyticsWorkspace', '2022-10-01', 'full').location]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('logAnalyticsWorkspace', '2022-10-01', 'full'), 'identity'), 'principalId'), '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "The log sink for Azure Diagnostics"
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('nsgContainerAppsEnvironment-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.containerAppsEnvironmentNsg]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "securityRules": {
+                    "value": [
+                      {
+                        "name": "Allow_Internal_AKS_Connection_Between_Nodes_And_Control_Plane_UDP",
+                        "properties": {
+                          "description": "internal AKS secure connection between underlying nodes and control plane..",
+                          "protocol": "Udp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "[format('AzureCloud.{0}', variables('locationVar'))]",
+                          "destinationPortRange": "1194",
+                          "access": "Allow",
+                          "priority": 100,
+                          "direction": "Outbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_Internal_AKS_Connection_Between_Nodes_And_Control_Plane_TCP",
+                        "properties": {
+                          "description": "internal AKS secure connection between underlying nodes and control plane..",
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "[format('AzureCloud.{0}', variables('locationVar'))]",
+                          "destinationPortRange": "9000",
+                          "access": "Allow",
+                          "priority": 110,
+                          "direction": "Outbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_Azure_Monitor",
+                        "properties": {
+                          "description": "Allows outbound calls to Azure Monitor.",
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "[format('AzureCloud.{0}', variables('locationVar'))]",
+                          "destinationPortRange": "443",
+                          "access": "Allow",
+                          "priority": 120,
+                          "direction": "Outbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_Outbound_443",
+                        "properties": {
+                          "description": "Allowing all outbound on port 443 provides a way to allow all FQDN based outbound dependencies that don't have a static IP",
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRange": "443",
+                          "access": "Allow",
+                          "priority": 130,
+                          "direction": "Outbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_NTP_Server",
+                        "properties": {
+                          "description": "NTP server",
+                          "protocol": "Udp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRange": "123",
+                          "access": "Allow",
+                          "priority": 140,
+                          "direction": "Outbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_Container_Apps_control_plane",
+                        "properties": {
+                          "description": "Container Apps control plane",
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRanges": [
+                            "5671",
+                            "5672"
+                          ],
+                          "access": "Allow",
+                          "priority": 150,
+                          "direction": "Outbound"
+                        }
+                      },
+                      {
+                        "name": "deny-hop-outbound",
+                        "properties": {
+                          "protocol": "*",
+                          "sourcePortRange": "*",
+                          "destinationPortRanges": [
+                            "3389",
+                            "22"
+                          ],
+                          "access": "Deny",
+                          "priority": 200,
+                          "direction": "Outbound",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "destinationAddressPrefix": "*"
+                        }
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "name": "logAnalyticsSettings",
+                        "workspaceResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.27.1.19265",
+                      "templateHash": "8543584719514494080"
+                    },
+                    "name": "Network Security Groups",
+                    "description": "This module deploys a Network security Group (NSG).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Network Security Group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "securityRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                      }
+                    },
+                    "flushConnection": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the NSG resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.2.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "networkSecurityGroup": {
+                      "type": "Microsoft.Network/networkSecurityGroups",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "securityRules",
+                            "count": "[length(parameters('securityRules'))]",
+                            "input": {
+                              "name": "[parameters('securityRules')[copyIndex('securityRules')].name]",
+                              "properties": {
+                                "protocol": "[parameters('securityRules')[copyIndex('securityRules')].properties.protocol]",
+                                "access": "[parameters('securityRules')[copyIndex('securityRules')].properties.access]",
+                                "priority": "[parameters('securityRules')[copyIndex('securityRules')].properties.priority]",
+                                "direction": "[parameters('securityRules')[copyIndex('securityRules')].properties.direction]",
+                                "description": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'description'), parameters('securityRules')[copyIndex('securityRules')].properties.description, '')]",
+                                "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRange, '')]",
+                                "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRanges, createArray())]",
+                                "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRange, '')]",
+                                "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRanges, createArray())]",
+                                "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefix, '')]",
+                                "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefix, '')]",
+                                "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefixes, createArray())]",
+                                "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefixes, createArray())]",
+                                "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceApplicationSecurityGroups, createArray())]",
+                                "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationApplicationSecurityGroups, createArray())]"
+                              }
+                            }
+                          }
+                        ],
+                        "flushConnection": "[parameters('flushConnection')]"
+                      }
+                    },
+                    "networkSecurityGroup_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_diagnosticSettings": {
+                      "copy": {
+                        "name": "networkSecurityGroup_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_roleAssignments": {
+                      "copy": {
+                        "name": "networkSecurityGroup_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_securityRules": {
+                      "copy": {
+                        "name": "networkSecurityGroup_securityRules",
+                        "count": "[length(parameters('securityRules'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-NetworkSecurityGroup-SecurityRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('securityRules')[copyIndex()].name]"
+                          },
+                          "networkSecurityGroupName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "protocol": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.protocol]"
+                          },
+                          "access": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.access]"
+                          },
+                          "priority": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.priority]"
+                          },
+                          "direction": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.direction]"
+                          },
+                          "description": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'description'), createObject('value', parameters('securityRules')[copyIndex()].properties.description), createObject('value', ''))]",
+                          "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRange), createObject('value', ''))]",
+                          "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRanges), createObject('value', createArray()))]",
+                          "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRange), createObject('value', ''))]",
+                          "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRanges), createObject('value', createArray()))]",
+                          "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefix), createObject('value', ''))]",
+                          "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefix), createObject('value', ''))]",
+                          "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefixes), createObject('value', createArray()))]",
+                          "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefixes), createObject('value', createArray()))]",
+                          "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceApplicationSecurityGroups), createObject('value', createArray()))]",
+                          "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationApplicationSecurityGroups), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "17252857850318600622"
+                            },
+                            "name": "Network Security Group (NSG) Security Rules",
+                            "description": "This module deploys a Network Security Group (NSG) Security Rule.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the security rule."
+                              }
+                            },
+                            "networkSecurityGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent network security group to deploy the security rule into. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "access": {
+                              "type": "string",
+                              "defaultValue": "Deny",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether network traffic is allowed or denied."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "maxLength": 140,
+                              "metadata": {
+                                "description": "Optional. A description for this rule."
+                              }
+                            },
+                            "destinationAddressPrefix": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                              }
+                            },
+                            "destinationAddressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                              }
+                            },
+                            "destinationApplicationSecurityGroups": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The application security group specified as destination."
+                              }
+                            },
+                            "destinationPortRange": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "destinationPortRanges": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The destination port ranges."
+                              }
+                            },
+                            "direction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Inbound",
+                                "Outbound"
+                              ],
+                              "metadata": {
+                                "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                              }
+                            },
+                            "priority": {
+                              "type": "int",
+                              "metadata": {
+                                "description": "Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                              }
+                            },
+                            "protocol": {
+                              "type": "string",
+                              "allowedValues": [
+                                "*",
+                                "Ah",
+                                "Esp",
+                                "Icmp",
+                                "Tcp",
+                                "Udp"
+                              ],
+                              "metadata": {
+                                "description": "Required. Network protocol this rule applies to."
+                              }
+                            },
+                            "sourceAddressPrefix": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                              }
+                            },
+                            "sourceAddressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP ranges."
+                              }
+                            },
+                            "sourceApplicationSecurityGroups": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The application security group specified as source."
+                              }
+                            },
+                            "sourcePortRange": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "sourcePortRanges": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The source port ranges."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
+                              "apiVersion": "2023-11-01",
+                              "name": "[format('{0}/{1}', parameters('networkSecurityGroupName'), parameters('name'))]",
+                              "properties": {
+                                "access": "[parameters('access')]",
+                                "description": "[parameters('description')]",
+                                "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
+                                "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]",
+                                "destinationApplicationSecurityGroups": "[parameters('destinationApplicationSecurityGroups')]",
+                                "destinationPortRange": "[parameters('destinationPortRange')]",
+                                "destinationPortRanges": "[parameters('destinationPortRanges')]",
+                                "direction": "[parameters('direction')]",
+                                "priority": "[parameters('priority')]",
+                                "protocol": "[parameters('protocol')]",
+                                "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
+                                "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
+                                "sourceApplicationSecurityGroups": "[parameters('sourceApplicationSecurityGroups')]",
+                                "sourcePortRange": "[parameters('sourcePortRange')]",
+                                "sourcePortRanges": "[parameters('sourcePortRanges')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the security rule was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the security rule."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups/securityRules', parameters('networkSecurityGroupName'), parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the security rule."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the network security group was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the network security group."
+                      },
+                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the network security group."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "Network security group rules for the Container Apps cluster."
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('spokeApplicationGatewaySubnetAddressPrefix')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('nsgAppGw-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGatewayNsg]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "securityRules": {
+                    "value": [
+                      {
+                        "name": "HealthProbes",
+                        "properties": {
+                          "description": "allow HealthProbes from gateway Manager.",
+                          "protocol": "*",
+                          "sourceAddressPrefix": "GatewayManager",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRange": "65200-65535",
+                          "access": "Allow",
+                          "priority": 100,
+                          "direction": "Inbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_TLS",
+                        "properties": {
+                          "description": "allow https incoming connections",
+                          "protocol": "*",
+                          "sourceAddressPrefix": "*",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRange": "443",
+                          "access": "Allow",
+                          "priority": 110,
+                          "direction": "Inbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_HTTP",
+                        "properties": {
+                          "description": "allow http incoming connections",
+                          "protocol": "*",
+                          "sourceAddressPrefix": "*",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRange": "80",
+                          "access": "Allow",
+                          "priority": 120,
+                          "direction": "Inbound"
+                        }
+                      },
+                      {
+                        "name": "Allow_AzureLoadBalancer",
+                        "properties": {
+                          "description": "allow AzureLoadBalancer incoming connections",
+                          "protocol": "*",
+                          "sourceAddressPrefix": "AzureLoadBalancer",
+                          "sourcePortRange": "*",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRange": "80",
+                          "access": "Allow",
+                          "priority": 130,
+                          "direction": "Inbound"
+                        }
+                      },
+                      {
+                        "name": "allow-all-outbound",
+                        "properties": {
+                          "protocol": "*",
+                          "sourcePortRange": "*",
+                          "destinationPortRange": "*",
+                          "access": "Allow",
+                          "priority": 210,
+                          "direction": "Outbound",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "destinationAddressPrefix": "*"
+                        }
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "name": "logAnalyticsSettings",
+                        "workspaceResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.27.1.19265",
+                      "templateHash": "8543584719514494080"
+                    },
+                    "name": "Network Security Groups",
+                    "description": "This module deploys a Network security Group (NSG).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Network Security Group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "securityRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                      }
+                    },
+                    "flushConnection": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the NSG resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.2.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "networkSecurityGroup": {
+                      "type": "Microsoft.Network/networkSecurityGroups",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "securityRules",
+                            "count": "[length(parameters('securityRules'))]",
+                            "input": {
+                              "name": "[parameters('securityRules')[copyIndex('securityRules')].name]",
+                              "properties": {
+                                "protocol": "[parameters('securityRules')[copyIndex('securityRules')].properties.protocol]",
+                                "access": "[parameters('securityRules')[copyIndex('securityRules')].properties.access]",
+                                "priority": "[parameters('securityRules')[copyIndex('securityRules')].properties.priority]",
+                                "direction": "[parameters('securityRules')[copyIndex('securityRules')].properties.direction]",
+                                "description": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'description'), parameters('securityRules')[copyIndex('securityRules')].properties.description, '')]",
+                                "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRange, '')]",
+                                "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRanges, createArray())]",
+                                "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRange, '')]",
+                                "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRanges, createArray())]",
+                                "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefix, '')]",
+                                "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefix, '')]",
+                                "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefixes, createArray())]",
+                                "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefixes, createArray())]",
+                                "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceApplicationSecurityGroups, createArray())]",
+                                "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationApplicationSecurityGroups, createArray())]"
+                              }
+                            }
+                          }
+                        ],
+                        "flushConnection": "[parameters('flushConnection')]"
+                      }
+                    },
+                    "networkSecurityGroup_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_diagnosticSettings": {
+                      "copy": {
+                        "name": "networkSecurityGroup_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_roleAssignments": {
+                      "copy": {
+                        "name": "networkSecurityGroup_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_securityRules": {
+                      "copy": {
+                        "name": "networkSecurityGroup_securityRules",
+                        "count": "[length(parameters('securityRules'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-NetworkSecurityGroup-SecurityRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('securityRules')[copyIndex()].name]"
+                          },
+                          "networkSecurityGroupName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "protocol": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.protocol]"
+                          },
+                          "access": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.access]"
+                          },
+                          "priority": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.priority]"
+                          },
+                          "direction": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.direction]"
+                          },
+                          "description": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'description'), createObject('value', parameters('securityRules')[copyIndex()].properties.description), createObject('value', ''))]",
+                          "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRange), createObject('value', ''))]",
+                          "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRanges), createObject('value', createArray()))]",
+                          "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRange), createObject('value', ''))]",
+                          "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRanges), createObject('value', createArray()))]",
+                          "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefix), createObject('value', ''))]",
+                          "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefix), createObject('value', ''))]",
+                          "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefixes), createObject('value', createArray()))]",
+                          "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefixes), createObject('value', createArray()))]",
+                          "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceApplicationSecurityGroups), createObject('value', createArray()))]",
+                          "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationApplicationSecurityGroups), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "17252857850318600622"
+                            },
+                            "name": "Network Security Group (NSG) Security Rules",
+                            "description": "This module deploys a Network Security Group (NSG) Security Rule.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the security rule."
+                              }
+                            },
+                            "networkSecurityGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent network security group to deploy the security rule into. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "access": {
+                              "type": "string",
+                              "defaultValue": "Deny",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether network traffic is allowed or denied."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "maxLength": 140,
+                              "metadata": {
+                                "description": "Optional. A description for this rule."
+                              }
+                            },
+                            "destinationAddressPrefix": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                              }
+                            },
+                            "destinationAddressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                              }
+                            },
+                            "destinationApplicationSecurityGroups": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The application security group specified as destination."
+                              }
+                            },
+                            "destinationPortRange": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "destinationPortRanges": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The destination port ranges."
+                              }
+                            },
+                            "direction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Inbound",
+                                "Outbound"
+                              ],
+                              "metadata": {
+                                "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                              }
+                            },
+                            "priority": {
+                              "type": "int",
+                              "metadata": {
+                                "description": "Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                              }
+                            },
+                            "protocol": {
+                              "type": "string",
+                              "allowedValues": [
+                                "*",
+                                "Ah",
+                                "Esp",
+                                "Icmp",
+                                "Tcp",
+                                "Udp"
+                              ],
+                              "metadata": {
+                                "description": "Required. Network protocol this rule applies to."
+                              }
+                            },
+                            "sourceAddressPrefix": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                              }
+                            },
+                            "sourceAddressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP ranges."
+                              }
+                            },
+                            "sourceApplicationSecurityGroups": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The application security group specified as source."
+                              }
+                            },
+                            "sourcePortRange": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "sourcePortRanges": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The source port ranges."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
+                              "apiVersion": "2023-11-01",
+                              "name": "[format('{0}/{1}', parameters('networkSecurityGroupName'), parameters('name'))]",
+                              "properties": {
+                                "access": "[parameters('access')]",
+                                "description": "[parameters('description')]",
+                                "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
+                                "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]",
+                                "destinationApplicationSecurityGroups": "[parameters('destinationApplicationSecurityGroups')]",
+                                "destinationPortRange": "[parameters('destinationPortRange')]",
+                                "destinationPortRanges": "[parameters('destinationPortRanges')]",
+                                "direction": "[parameters('direction')]",
+                                "priority": "[parameters('priority')]",
+                                "protocol": "[parameters('protocol')]",
+                                "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
+                                "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
+                                "sourceApplicationSecurityGroups": "[parameters('sourceApplicationSecurityGroups')]",
+                                "sourcePortRange": "[parameters('sourcePortRange')]",
+                                "sourcePortRanges": "[parameters('sourcePortRanges')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the security rule was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the security rule."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups/securityRules', parameters('networkSecurityGroupName'), parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the security rule."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the network security group was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the network security group."
+                      },
+                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the network security group."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "NSG Rules for the Application Gateway."
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('nsgPep-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.pepNsg]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "securityRules": {
+                    "value": [
+                      {
+                        "name": "deny-hop-outbound",
+                        "properties": {
+                          "protocol": "*",
+                          "sourcePortRange": "*",
+                          "destinationPortRanges": [
+                            "3389",
+                            "22"
+                          ],
+                          "access": "Deny",
+                          "priority": 200,
+                          "direction": "Outbound",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "destinationAddressPrefix": "*"
+                        }
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "name": "logAnalyticsSettings",
+                        "workspaceResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.27.1.19265",
+                      "templateHash": "8543584719514494080"
+                    },
+                    "name": "Network Security Groups",
+                    "description": "This module deploys a Network security Group (NSG).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Network Security Group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "securityRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                      }
+                    },
+                    "flushConnection": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the NSG resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.2.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "networkSecurityGroup": {
+                      "type": "Microsoft.Network/networkSecurityGroups",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "securityRules",
+                            "count": "[length(parameters('securityRules'))]",
+                            "input": {
+                              "name": "[parameters('securityRules')[copyIndex('securityRules')].name]",
+                              "properties": {
+                                "protocol": "[parameters('securityRules')[copyIndex('securityRules')].properties.protocol]",
+                                "access": "[parameters('securityRules')[copyIndex('securityRules')].properties.access]",
+                                "priority": "[parameters('securityRules')[copyIndex('securityRules')].properties.priority]",
+                                "direction": "[parameters('securityRules')[copyIndex('securityRules')].properties.direction]",
+                                "description": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'description'), parameters('securityRules')[copyIndex('securityRules')].properties.description, '')]",
+                                "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRange, '')]",
+                                "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRanges, createArray())]",
+                                "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRange, '')]",
+                                "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRanges, createArray())]",
+                                "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefix, '')]",
+                                "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefix, '')]",
+                                "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefixes, createArray())]",
+                                "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefixes, createArray())]",
+                                "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceApplicationSecurityGroups, createArray())]",
+                                "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationApplicationSecurityGroups, createArray())]"
+                              }
+                            }
+                          }
+                        ],
+                        "flushConnection": "[parameters('flushConnection')]"
+                      }
+                    },
+                    "networkSecurityGroup_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_diagnosticSettings": {
+                      "copy": {
+                        "name": "networkSecurityGroup_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_roleAssignments": {
+                      "copy": {
+                        "name": "networkSecurityGroup_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_securityRules": {
+                      "copy": {
+                        "name": "networkSecurityGroup_securityRules",
+                        "count": "[length(parameters('securityRules'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-NetworkSecurityGroup-SecurityRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('securityRules')[copyIndex()].name]"
+                          },
+                          "networkSecurityGroupName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "protocol": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.protocol]"
+                          },
+                          "access": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.access]"
+                          },
+                          "priority": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.priority]"
+                          },
+                          "direction": {
+                            "value": "[parameters('securityRules')[copyIndex()].properties.direction]"
+                          },
+                          "description": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'description'), createObject('value', parameters('securityRules')[copyIndex()].properties.description), createObject('value', ''))]",
+                          "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRange), createObject('value', ''))]",
+                          "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRanges), createObject('value', createArray()))]",
+                          "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRange), createObject('value', ''))]",
+                          "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRanges), createObject('value', createArray()))]",
+                          "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefix), createObject('value', ''))]",
+                          "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefix), createObject('value', ''))]",
+                          "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefixes), createObject('value', createArray()))]",
+                          "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefixes), createObject('value', createArray()))]",
+                          "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceApplicationSecurityGroups), createObject('value', createArray()))]",
+                          "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationApplicationSecurityGroups), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "17252857850318600622"
+                            },
+                            "name": "Network Security Group (NSG) Security Rules",
+                            "description": "This module deploys a Network Security Group (NSG) Security Rule.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the security rule."
+                              }
+                            },
+                            "networkSecurityGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent network security group to deploy the security rule into. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "access": {
+                              "type": "string",
+                              "defaultValue": "Deny",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether network traffic is allowed or denied."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "maxLength": 140,
+                              "metadata": {
+                                "description": "Optional. A description for this rule."
+                              }
+                            },
+                            "destinationAddressPrefix": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                              }
+                            },
+                            "destinationAddressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                              }
+                            },
+                            "destinationApplicationSecurityGroups": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The application security group specified as destination."
+                              }
+                            },
+                            "destinationPortRange": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "destinationPortRanges": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The destination port ranges."
+                              }
+                            },
+                            "direction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Inbound",
+                                "Outbound"
+                              ],
+                              "metadata": {
+                                "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                              }
+                            },
+                            "priority": {
+                              "type": "int",
+                              "metadata": {
+                                "description": "Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                              }
+                            },
+                            "protocol": {
+                              "type": "string",
+                              "allowedValues": [
+                                "*",
+                                "Ah",
+                                "Esp",
+                                "Icmp",
+                                "Tcp",
+                                "Udp"
+                              ],
+                              "metadata": {
+                                "description": "Required. Network protocol this rule applies to."
+                              }
+                            },
+                            "sourceAddressPrefix": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                              }
+                            },
+                            "sourceAddressPrefixes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP ranges."
+                              }
+                            },
+                            "sourceApplicationSecurityGroups": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The application security group specified as source."
+                              }
+                            },
+                            "sourcePortRange": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "sourcePortRanges": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The source port ranges."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
+                              "apiVersion": "2023-11-01",
+                              "name": "[format('{0}/{1}', parameters('networkSecurityGroupName'), parameters('name'))]",
+                              "properties": {
+                                "access": "[parameters('access')]",
+                                "description": "[parameters('description')]",
+                                "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
+                                "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]",
+                                "destinationApplicationSecurityGroups": "[parameters('destinationApplicationSecurityGroups')]",
+                                "destinationPortRange": "[parameters('destinationPortRange')]",
+                                "destinationPortRanges": "[parameters('destinationPortRanges')]",
+                                "direction": "[parameters('direction')]",
+                                "priority": "[parameters('priority')]",
+                                "protocol": "[parameters('protocol')]",
+                                "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
+                                "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
+                                "sourceApplicationSecurityGroups": "[parameters('sourceApplicationSecurityGroups')]",
+                                "sourcePortRange": "[parameters('sourcePortRange')]",
+                                "sourcePortRanges": "[parameters('sourcePortRanges')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the security rule was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the security rule."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups/securityRules', parameters('networkSecurityGroupName'), parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the security rule."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the network security group was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the network security group."
+                      },
+                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the network security group."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "NSG Rules for the private enpoint subnet."
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('hubVNetId'))), not(empty(parameters('networkApplianceIpAddress'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('egressLockdownUdr-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.routeTable]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "routes": {
+                    "value": [
+                      {
+                        "name": "defaultEgressLockdown",
+                        "properties": {
+                          "addressPrefix": "0.0.0.0/0",
+                          "nextHopType": "VirtualAppliance",
+                          "nextHopIpAddress": "[parameters('networkApplianceIpAddress')]"
+                        }
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.25.53.49325",
+                      "templateHash": "4697655308606864167"
+                    },
+                    "name": "Route Tables",
+                    "description": "This module deploys a User Defined Route Table (UDR).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "routeType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Name of the route."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "nextHopType": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "Internet",
+                                  "None",
+                                  "VirtualAppliance",
+                                  "VirtualNetworkGateway",
+                                  "VnetLocal"
+                                ],
+                                "metadata": {
+                                  "description": "Required. The type of Azure hop the packet should be sent to."
+                                }
+                              },
+                              "addressPrefix": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The destination CIDR to which the route applies."
+                                }
+                              },
+                              "hasBgpOverride": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. A value indicating whether this route overrides overlapping BGP routes regardless of LPM."
+                                }
+                              },
+                              "nextHopIpAddress": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The IP address packets should be forwarded to. Next hop values are only allowed in routes where the next hop type is VirtualAppliance."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of the route."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name given for the hub route table."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "routes": {
+                      "$ref": "#/definitions/routeType",
+                      "metadata": {
+                        "description": "Optional. An array of routes to be established within the hub route table."
+                      }
+                    },
+                    "disableBgpRoutePropagation": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Switch to disable BGP route propagation."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[take(format('46d3xbcp.res.network-routetable.{0}.{1}', replace('0.2.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4)), 64)]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "routeTable": {
+                      "type": "Microsoft.Network/routeTables",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "routes": "[parameters('routes')]",
+                        "disableBgpRoutePropagation": "[parameters('disableBgpRoutePropagation')]"
+                      }
+                    },
+                    "routeTable_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/routeTables/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "routeTable"
+                      ]
+                    },
+                    "routeTable_roleAssignments": {
+                      "copy": {
+                        "name": "routeTable_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/routeTables/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/routeTables', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "routeTable"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the route table was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the route table."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the route table."
+                      },
+                      "value": "[resourceId('Microsoft.Network/routeTables', parameters('name'))]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('routeTable', '2023-04-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "The Route Table deployment"
+              }
+            },
+            {
+              "condition": "[equals(parameters('vmJumpboxOSType'), 'linux')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('vm-linux-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "vmName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBox]"
+                  },
+                  "bastionResourceId": {
+                    "value": "[parameters('bastionResourceId')]"
+                  },
+                  "vmAdminUsername": {
+                    "value": "[parameters('vmAdminUsername')]"
+                  },
+                  "vmAdminPassword": {
+                    "value": "[parameters('vmAdminPassword')]"
+                  },
+                  "vmSshPublicKey": {
+                    "value": "[parameters('vmLinuxSshAuthorizedKey')]"
+                  },
+                  "vmSize": {
+                    "value": "[parameters('vmSize')]"
+                  },
+                  "vmZone": {
+                    "value": "[parameters('vmZone')]"
+                  },
+                  "storageAccountType": {
+                    "value": "[parameters('storageAccountType')]"
+                  },
+                  "vmVnetName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64)), '2022-09-01').outputs.name.value]"
+                  },
+                  "vmSubnetName": {
+                    "value": "[parameters('vmSubnetName')]"
+                  },
+                  "vmSubnetAddressPrefix": {
+                    "value": "[parameters('vmJumpBoxSubnetAddressPrefix')]"
+                  },
+                  "vmNetworkInterfaceName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBoxNic]"
+                  },
+                  "vmNetworkSecurityGroupName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBoxNsg]"
+                  },
+                  "vmAuthenticationType": {
+                    "value": "[parameters('vmAuthenticationType')]"
+                  },
+                  "logAnalyticsWorkspaceResourceId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "15037342818970325221"
+                    }
+                  },
+                  "parameters": {
+                    "vmName": {
+                      "type": "string"
+                    },
+                    "vmSize": {
+                      "type": "string"
+                    },
+                    "storageAccountType": {
+                      "type": "string",
+                      "defaultValue": "Standard_LRS"
+                    },
+                    "vmZone": {
+                      "type": "int",
+                      "defaultValue": 0
+                    },
+                    "vmVnetName": {
+                      "type": "string"
+                    },
+                    "vmSubnetName": {
+                      "type": "string"
+                    },
+                    "vmSubnetAddressPrefix": {
+                      "type": "string"
+                    },
+                    "vmNetworkSecurityGroupName": {
+                      "type": "string"
+                    },
+                    "vmNetworkInterfaceName": {
+                      "type": "string"
+                    },
+                    "logAnalyticsWorkspaceResourceId": {
+                      "type": "string"
+                    },
+                    "bastionResourceId": {
+                      "type": "string"
+                    },
+                    "vmAdminUsername": {
+                      "type": "string"
+                    },
+                    "vmAdminPassword": {
+                      "type": "securestring"
+                    },
+                    "vmSshPublicKey": {
+                      "type": "securestring"
+                    },
+                    "vmAuthenticationType": {
+                      "type": "string",
+                      "defaultValue": "password",
+                      "allowedValues": [
+                        "sshPublicKey",
+                        "password"
+                      ],
+                      "metadata": {
+                        "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The tags to be assigned to the created resources."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Whether to enable deplotment telemetry."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]"
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Network/virtualNetworks/subnets",
+                      "apiVersion": "2023-11-01",
+                      "name": "[format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName'))]",
+                      "properties": {
+                        "addressPrefix": "[parameters('vmSubnetAddressPrefix')]",
+                        "networkSecurityGroup": {
+                          "id": "[reference(resourceId('Microsoft.Resources/deployments', 'vmNetworkSecurityDeployment'), '2022-09-01').outputs.resourceId.value]"
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Resources/deployments', 'vmNetworkSecurityDeployment')]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Maintenance/maintenanceConfigurations",
+                      "apiVersion": "2023-10-01-preview",
+                      "name": "[format('dep-mc-{0}', parameters('vmName'))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "extensionProperties": {
+                          "InGuestPatchMode": "User"
+                        },
+                        "maintenanceScope": "InGuestPatch",
+                        "maintenanceWindow": {
+                          "startDateTime": "2024-06-16 00:00",
+                          "duration": "03:55",
+                          "timeZone": "W. Europe Standard Time",
+                          "recurEvery": "1Day"
+                        },
+                        "visibility": "Custom",
+                        "installPatches": {
+                          "rebootSetting": "IfRequired",
+                          "linuxParameters": {
+                            "classificationsToInclude": [
+                              "Critical",
+                              "Security"
+                            ]
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "vmNetworkSecurityDeployment",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('vmNetworkSecurityGroupName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "securityRules": "[if(not(empty(parameters('bastionResourceId'))), createObject('value', createArray(createObject('name', 'allow-bastion-inbound', 'properties', createObject('description', 'Allow inbound traffic from Bastion to the JumpBox', 'protocol', '*', 'sourceAddressPrefix', 'Bastion', 'sourcePortRange', '*', 'destinationAddressPrefix', '*', 'destinationPortRange', '*', 'access', 'Allow', 'priority', 100, 'direction', 'Inbound')))), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "8543584719514494080"
+                            },
+                            "name": "Network Security Groups",
+                            "description": "This module deploys a Network security Group (NSG).",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Network Security Group."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "securityRules": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                              }
+                            },
+                            "flushConnection": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the NSG resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.2.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "networkSecurityGroup": {
+                              "type": "Microsoft.Network/networkSecurityGroups",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "securityRules",
+                                    "count": "[length(parameters('securityRules'))]",
+                                    "input": {
+                                      "name": "[parameters('securityRules')[copyIndex('securityRules')].name]",
+                                      "properties": {
+                                        "protocol": "[parameters('securityRules')[copyIndex('securityRules')].properties.protocol]",
+                                        "access": "[parameters('securityRules')[copyIndex('securityRules')].properties.access]",
+                                        "priority": "[parameters('securityRules')[copyIndex('securityRules')].properties.priority]",
+                                        "direction": "[parameters('securityRules')[copyIndex('securityRules')].properties.direction]",
+                                        "description": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'description'), parameters('securityRules')[copyIndex('securityRules')].properties.description, '')]",
+                                        "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRange, '')]",
+                                        "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRanges, createArray())]",
+                                        "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRange, '')]",
+                                        "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRanges, createArray())]",
+                                        "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefix, '')]",
+                                        "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefix, '')]",
+                                        "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefixes, createArray())]",
+                                        "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefixes, createArray())]",
+                                        "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceApplicationSecurityGroups, createArray())]",
+                                        "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationApplicationSecurityGroups, createArray())]"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "flushConnection": "[parameters('flushConnection')]"
+                              }
+                            },
+                            "networkSecurityGroup_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_diagnosticSettings": {
+                              "copy": {
+                                "name": "networkSecurityGroup_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_roleAssignments": {
+                              "copy": {
+                                "name": "networkSecurityGroup_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_securityRules": {
+                              "copy": {
+                                "name": "networkSecurityGroup_securityRules",
+                                "count": "[length(parameters('securityRules'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-NetworkSecurityGroup-SecurityRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('securityRules')[copyIndex()].name]"
+                                  },
+                                  "networkSecurityGroupName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "protocol": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.protocol]"
+                                  },
+                                  "access": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.access]"
+                                  },
+                                  "priority": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.priority]"
+                                  },
+                                  "direction": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.direction]"
+                                  },
+                                  "description": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'description'), createObject('value', parameters('securityRules')[copyIndex()].properties.description), createObject('value', ''))]",
+                                  "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRange), createObject('value', ''))]",
+                                  "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRanges), createObject('value', createArray()))]",
+                                  "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRange), createObject('value', ''))]",
+                                  "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRanges), createObject('value', createArray()))]",
+                                  "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefix), createObject('value', ''))]",
+                                  "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefix), createObject('value', ''))]",
+                                  "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefixes), createObject('value', createArray()))]",
+                                  "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefixes), createObject('value', createArray()))]",
+                                  "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceApplicationSecurityGroups), createObject('value', createArray()))]",
+                                  "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationApplicationSecurityGroups), createObject('value', createArray()))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "17252857850318600622"
+                                    },
+                                    "name": "Network Security Group (NSG) Security Rules",
+                                    "description": "This module deploys a Network Security Group (NSG) Security Rule.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the security rule."
+                                      }
+                                    },
+                                    "networkSecurityGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent network security group to deploy the security rule into. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "access": {
+                                      "type": "string",
+                                      "defaultValue": "Deny",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether network traffic is allowed or denied."
+                                      }
+                                    },
+                                    "description": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "maxLength": 140,
+                                      "metadata": {
+                                        "description": "Optional. A description for this rule."
+                                      }
+                                    },
+                                    "destinationAddressPrefix": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                                      }
+                                    },
+                                    "destinationAddressPrefixes": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                                      }
+                                    },
+                                    "destinationApplicationSecurityGroups": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The application security group specified as destination."
+                                      }
+                                    },
+                                    "destinationPortRange": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                                      }
+                                    },
+                                    "destinationPortRanges": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The destination port ranges."
+                                      }
+                                    },
+                                    "direction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Inbound",
+                                        "Outbound"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                                      }
+                                    },
+                                    "priority": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                                      }
+                                    },
+                                    "protocol": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "*",
+                                        "Ah",
+                                        "Esp",
+                                        "Icmp",
+                                        "Tcp",
+                                        "Udp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Network protocol this rule applies to."
+                                      }
+                                    },
+                                    "sourceAddressPrefix": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                                      }
+                                    },
+                                    "sourceAddressPrefixes": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The CIDR or source IP ranges."
+                                      }
+                                    },
+                                    "sourceApplicationSecurityGroups": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The application security group specified as source."
+                                      }
+                                    },
+                                    "sourcePortRange": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                                      }
+                                    },
+                                    "sourcePortRanges": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The source port ranges."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
+                                      "apiVersion": "2023-11-01",
+                                      "name": "[format('{0}/{1}', parameters('networkSecurityGroupName'), parameters('name'))]",
+                                      "properties": {
+                                        "access": "[parameters('access')]",
+                                        "description": "[parameters('description')]",
+                                        "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
+                                        "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]",
+                                        "destinationApplicationSecurityGroups": "[parameters('destinationApplicationSecurityGroups')]",
+                                        "destinationPortRange": "[parameters('destinationPortRange')]",
+                                        "destinationPortRanges": "[parameters('destinationPortRanges')]",
+                                        "direction": "[parameters('direction')]",
+                                        "priority": "[parameters('priority')]",
+                                        "protocol": "[parameters('protocol')]",
+                                        "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
+                                        "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
+                                        "sourceApplicationSecurityGroups": "[parameters('sourceApplicationSecurityGroups')]",
+                                        "sourcePortRange": "[parameters('sourcePortRange')]",
+                                        "sourcePortRanges": "[parameters('sourcePortRanges')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the security rule was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the security rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups/securityRules', parameters('networkSecurityGroupName'), parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the security rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the network security group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the network security group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the network security group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "vmDeployment",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('vmName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "osType": {
+                            "value": "Linux"
+                          },
+                          "computerName": {
+                            "value": "[parameters('vmName')]"
+                          },
+                          "adminUsername": {
+                            "value": "[parameters('vmAdminUsername')]"
+                          },
+                          "adminPassword": "[if(equals(parameters('vmAuthenticationType'), 'password'), createObject('value', parameters('vmAdminPassword')), createObject('value', null()))]",
+                          "disablePasswordAuthentication": "[if(equals(parameters('vmAuthenticationType'), 'password'), createObject('value', false()), createObject('value', true()))]",
+                          "encryptionAtHost": {
+                            "value": false
+                          },
+                          "enableAutomaticUpdates": {
+                            "value": true
+                          },
+                          "patchMode": {
+                            "value": "AutomaticByPlatform"
+                          },
+                          "bypassPlatformSafetyChecksOnUserSchedule": {
+                            "value": true
+                          },
+                          "maintenanceConfigurationResourceId": {
+                            "value": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', format('dep-mc-{0}', parameters('vmName')))]"
+                          },
+                          "publicKeys": "[if(equals(parameters('vmAuthenticationType'), 'sshPublicKey'), createObject('value', createArray(createObject('keyData', parameters('vmSshPublicKey'), 'path', format('/home/{0}/.ssh/authorized_keys', parameters('vmAdminUsername'))))), createObject('value', createArray()))]",
+                          "nicConfigurations": {
+                            "value": [
+                              {
+                                "name": "[parameters('vmNetworkInterfaceName')]",
+                                "enableAcceleratedNetworking": false,
+                                "ipConfigurations": [
+                                  {
+                                    "name": "ipConfig01",
+                                    "privateIPAllocationMethod": "Dynamic",
+                                    "subnetResourceId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[0], split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[1])]"
+                                  }
+                                ]
+                              }
+                            ]
+                          },
+                          "osDisk": {
+                            "value": {
+                              "caching": "ReadWrite",
+                              "createOption": "FromImage",
+                              "deleteOption": "Delete",
+                              "diskSizeGB": 128,
+                              "managedDisk": {
+                                "storageAccountType": "[parameters('storageAccountType')]"
+                              }
+                            }
+                          },
+                          "zone": {
+                            "value": "[parameters('vmZone')]"
+                          },
+                          "vmSize": {
+                            "value": "[parameters('vmSize')]"
+                          },
+                          "imageReference": {
+                            "value": {
+                              "publisher": "canonical",
+                              "offer": "0001-com-ubuntu-server-focal",
+                              "sku": "20_04-lts-gen2",
+                              "version": "latest"
+                            }
+                          },
+                          "extensionMonitoringAgentConfig": {
+                            "value": {
+                              "enabled": true,
+                              "tags": "[parameters('tags')]",
+                              "monitoringWorkspaceResourceId": "[parameters('logAnalyticsWorkspaceResourceId')]"
+                            }
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "7195052428088092384"
+                            },
+                            "name": "Virtual Machines",
+                            "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "managedIdentitiesType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "osDiskType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The disk name."
+                                  }
+                                },
+                                "diskSizeGB": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. Specifies the size of an empty data disk in gigabytes."
+                                  }
+                                },
+                                "createOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Attach",
+                                    "Empty",
+                                    "FromImage"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies how the virtual machine should be created."
+                                  }
+                                },
+                                "deleteOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Delete",
+                                    "Detach"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                                  }
+                                },
+                                "caching": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "None",
+                                    "ReadOnly",
+                                    "ReadWrite"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the caching requirements."
+                                  }
+                                },
+                                "managedDisk": {
+                                  "type": "object",
+                                  "properties": {
+                                    "storageAccountType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "PremiumV2_LRS",
+                                        "Premium_LRS",
+                                        "Premium_ZRS",
+                                        "StandardSSD_LRS",
+                                        "StandardSSD_ZRS",
+                                        "Standard_LRS",
+                                        "UltraSSD_LRS"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Specifies the storage account type for the managed disk."
+                                      }
+                                    },
+                                    "diskEncryptionSetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The managed disk parameters."
+                                  }
+                                }
+                              }
+                            },
+                            "dataDisksType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The disk name."
+                                    }
+                                  },
+                                  "lun": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies the logical unit number of the data disk."
+                                    }
+                                  },
+                                  "diskSizeGB": {
+                                    "type": "int",
+                                    "metadata": {
+                                      "description": "Required. Specifies the size of an empty data disk in gigabytes."
+                                    }
+                                  },
+                                  "createOption": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Attach",
+                                      "Empty",
+                                      "FromImage"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies how the virtual machine should be created."
+                                    }
+                                  },
+                                  "deleteOption": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Delete",
+                                      "Detach"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                                    }
+                                  },
+                                  "caching": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "None",
+                                      "ReadOnly",
+                                      "ReadWrite"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies the caching requirements."
+                                    }
+                                  },
+                                  "managedDisk": {
+                                    "type": "object",
+                                    "properties": {
+                                      "storageAccountType": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "PremiumV2_LRS",
+                                          "Premium_LRS",
+                                          "Premium_ZRS",
+                                          "StandardSSD_LRS",
+                                          "StandardSSD_ZRS",
+                                          "Standard_LRS",
+                                          "UltraSSD_LRS"
+                                        ],
+                                        "metadata": {
+                                          "description": "Required. Specifies the storage account type for the managed disk."
+                                        }
+                                      },
+                                      "diskEncryptionSetResourceId": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                                        }
+                                      }
+                                    },
+                                    "metadata": {
+                                      "description": "Required. The managed disk parameters."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
+                              }
+                            },
+                            "computerName": {
+                              "type": "string",
+                              "defaultValue": "[parameters('name')]",
+                              "metadata": {
+                                "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
+                              }
+                            },
+                            "vmSize": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the size for the VMs."
+                              }
+                            },
+                            "encryptionAtHost": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "securityType": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "secureBootEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "vTpmEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "imageReference": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "Required. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image."
+                              }
+                            },
+                            "plan": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
+                              }
+                            },
+                            "osDisk": {
+                              "$ref": "#/definitions/osDiskType",
+                              "metadata": {
+                                "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "dataDisks": {
+                              "$ref": "#/definitions/dataDisksType",
+                              "metadata": {
+                                "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "ultraSSDEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
+                              }
+                            },
+                            "adminUsername": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "Required. Administrator username."
+                              }
+                            },
+                            "adminPassword": {
+                              "type": "securestring",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. When specifying a Windows Virtual Machine, this value should be passed."
+                              }
+                            },
+                            "customData": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
+                              }
+                            },
+                            "certificatesToBeInstalled": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
+                              }
+                            },
+                            "priority": {
+                              "type": "string",
+                              "defaultValue": "Regular",
+                              "allowedValues": [
+                                "Regular",
+                                "Low",
+                                "Spot"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the priority for the virtual machine."
+                              }
+                            },
+                            "enableEvictionPolicy": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies the eviction policy for the low priority virtual machine. Will result in 'Deallocate' eviction policy."
+                              }
+                            },
+                            "maxPriceForLowPriorityVm": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
+                              }
+                            },
+                            "dedicatedHostId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
+                              }
+                            },
+                            "licenseType": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "RHEL_BYOS",
+                                "SLES_BYOS",
+                                "Windows_Client",
+                                "Windows_Server",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
+                              }
+                            },
+                            "publicKeys": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentitiesType",
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
+                              }
+                            },
+                            "bootDiagnostics": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
+                              }
+                            },
+                            "bootDiagnosticStorageAccountName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
+                              }
+                            },
+                            "bootDiagnosticStorageAccountUri": {
+                              "type": "string",
+                              "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
+                              "metadata": {
+                                "description": "Optional. Storage account boot diagnostic base URI."
+                              }
+                            },
+                            "proximityPlacementGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of a proximity placement group."
+                              }
+                            },
+                            "virtualMachineScaleSetResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
+                              }
+                            },
+                            "availabilitySetResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
+                              }
+                            },
+                            "galleryApplications": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
+                              }
+                            },
+                            "zone": {
+                              "type": "int",
+                              "allowedValues": [
+                                0,
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Required. If set to 1, 2 or 3, the availability zone for all VMs is hardcoded to that value. If zero, then availability zones is not used. Cannot be used in combination with availability set nor scale set."
+                              }
+                            },
+                            "nicConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. Configures NICs and PIPs."
+                              }
+                            },
+                            "backupVaultName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Recovery service vault name to add VMs to backup."
+                              }
+                            },
+                            "backupVaultResourceGroup": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().name]",
+                              "metadata": {
+                                "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
+                              }
+                            },
+                            "backupPolicyName": {
+                              "type": "string",
+                              "defaultValue": "DefaultPolicy",
+                              "metadata": {
+                                "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
+                              }
+                            },
+                            "autoShutdownConfig": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The configuration for auto-shutdown."
+                              }
+                            },
+                            "maintenanceConfigurationResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource Id of a maintenance configuration for this VM."
+                              }
+                            },
+                            "allowExtensionOperations": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
+                              }
+                            },
+                            "extensionDomainJoinPassword": {
+                              "type": "securestring",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
+                              }
+                            },
+                            "extensionDomainJoinConfig": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionAadJoinConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
+                              }
+                            },
+                            "extensionAntiMalwareConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionMonitoringAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionDependencyAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionNetworkWatcherAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionAzureDiskEncryptionConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
+                              }
+                            },
+                            "extensionDSCConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionCustomScriptConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false,
+                                "fileData": []
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Custom Script] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionNvidiaGpuDriverWindows": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionHostPoolRegistration": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+                              }
+                            },
+                            "extensionGuestConfigurationExtension": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+                              }
+                            },
+                            "guestConfiguration": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
+                              }
+                            },
+                            "extensionCustomScriptProtectedSetting": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. An object that contains the extension specific protected settings."
+                              }
+                            },
+                            "extensionGuestConfigurationExtensionProtectedSettings": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. An object that contains the extension specific protected settings."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "baseTime": {
+                              "type": "string",
+                              "defaultValue": "[utcNow('u')]",
+                              "metadata": {
+                                "description": "Generated. Do not provide a value! This date value is used to generate a registration token."
+                              }
+                            },
+                            "sasTokenValidityLength": {
+                              "type": "string",
+                              "defaultValue": "PT8H",
+                              "metadata": {
+                                "description": "Optional. SAS token validity length to use to download files from storage accounts. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours."
+                              }
+                            },
+                            "osType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Windows",
+                                "Linux"
+                              ],
+                              "metadata": {
+                                "description": "Required. The chosen OS type."
+                              }
+                            },
+                            "disablePasswordAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether password authentication should be disabled."
+                              }
+                            },
+                            "provisionVMAgent": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
+                              }
+                            },
+                            "enableAutomaticUpdates": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
+                              }
+                            },
+                            "patchMode": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "AutomaticByPlatform",
+                                "AutomaticByOS",
+                                "Manual",
+                                "ImageDefault",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+                              }
+                            },
+                            "bypassPlatformSafetyChecksOnUserSchedule": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enables customer to schedule patching without accidental upgrades."
+                              }
+                            },
+                            "rebootSetting": {
+                              "type": "string",
+                              "defaultValue": "IfRequired",
+                              "allowedValues": [
+                                "Always",
+                                "IfRequired",
+                                "Never",
+                                "Unknown"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
+                              }
+                            },
+                            "patchAssessmentMode": {
+                              "type": "string",
+                              "defaultValue": "ImageDefault",
+                              "allowedValues": [
+                                "AutomaticByPlatform",
+                                "ImageDefault"
+                              ],
+                              "metadata": {
+                                "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
+                              }
+                            },
+                            "timeZone": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
+                              }
+                            },
+                            "additionalUnattendContent": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
+                              }
+                            },
+                            "winRM": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell. - WinRMConfiguration object."
+                              }
+                            },
+                            "configurationProfile": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "publicKeysFormatted",
+                                "count": "[length(parameters('publicKeys'))]",
+                                "input": {
+                                  "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
+                                  "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
+                                }
+                              }
+                            ],
+                            "linuxConfiguration": {
+                              "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
+                              "ssh": {
+                                "publicKeys": "[variables('publicKeysFormatted')]"
+                              },
+                              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
+                            },
+                            "windowsConfiguration": {
+                              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                              "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
+                              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+                              "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
+                              "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), parameters('additionalUnattendContent'))]",
+                              "winRM": "[if(not(empty(parameters('winRM'))), createObject('listeners', parameters('winRM')), null())]"
+                            },
+                            "accountSasProperties": {
+                              "signedServices": "b",
+                              "signedPermission": "r",
+                              "signedExpiry": "[dateTimeAdd(parameters('baseTime'), parameters('sasTokenValidityLength'))]",
+                              "signedResourceTypes": "o",
+                              "signedProtocol": "https"
+                            },
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
+                              "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
+                              "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
+                              "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
+                              "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
+                              "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
+                              "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
+                              "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
+                              "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
+                              "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
+                              "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
+                              "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "vm": {
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2023-09-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "zones": "[if(not(equals(parameters('zone'), 0)), array(string(parameters('zone'))), null())]",
+                              "plan": "[if(not(empty(parameters('plan'))), parameters('plan'), null())]",
+                              "properties": {
+                                "hardwareProfile": {
+                                  "vmSize": "[parameters('vmSize')]"
+                                },
+                                "securityProfile": {
+                                  "encryptionAtHost": "[if(parameters('encryptionAtHost'), parameters('encryptionAtHost'), null())]",
+                                  "securityType": "[parameters('securityType')]",
+                                  "uefiSettings": "[if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null())]"
+                                },
+                                "storageProfile": {
+                                  "copy": [
+                                    {
+                                      "name": "dataDisks",
+                                      "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
+                                      "input": {
+                                        "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
+                                        "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))]",
+                                        "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].diskSizeGB]",
+                                        "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createoption'), 'Empty')]",
+                                        "deleteOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete')]",
+                                        "caching": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly')]",
+                                        "managedDisk": {
+                                          "storageAccountType": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.storageAccountType]",
+                                          "diskEncryptionSet": {
+                                            "id": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId')]"
+                                          }
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "imageReference": "[parameters('imageReference')]",
+                                  "osDisk": {
+                                    "name": "[coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name')))]",
+                                    "createOption": "[coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage')]",
+                                    "deleteOption": "[coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete')]",
+                                    "diskSizeGB": "[parameters('osDisk').diskSizeGB]",
+                                    "caching": "[coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly')]",
+                                    "managedDisk": {
+                                      "storageAccountType": "[parameters('osDisk').managedDisk.storageAccountType]",
+                                      "diskEncryptionSet": {
+                                        "id": "[tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')]"
+                                      }
+                                    }
+                                  }
+                                },
+                                "additionalCapabilities": {
+                                  "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]"
+                                },
+                                "osProfile": {
+                                  "computerName": "[parameters('computerName')]",
+                                  "adminUsername": "[parameters('adminUsername')]",
+                                  "adminPassword": "[parameters('adminPassword')]",
+                                  "customData": "[if(not(empty(parameters('customData'))), base64(parameters('customData')), null())]",
+                                  "windowsConfiguration": "[if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null())]",
+                                  "linuxConfiguration": "[if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null())]",
+                                  "secrets": "[parameters('certificatesToBeInstalled')]",
+                                  "allowExtensionOperations": "[parameters('allowExtensionOperations')]"
+                                },
+                                "networkProfile": {
+                                  "copy": [
+                                    {
+                                      "name": "networkInterfaces",
+                                      "count": "[length(parameters('nicConfigurations'))]",
+                                      "input": {
+                                        "properties": {
+                                          "deleteOption": "[if(contains(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].deleteOption, 'Delete')]",
+                                          "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
+                                        },
+                                        "id": "[resourceId('Microsoft.Network/networkInterfaces', if(contains(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].name, format('{0}{1}', parameters('name'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].nicSuffix)))]"
+                                      }
+                                    }
+                                  ]
+                                },
+                                "diagnosticsProfile": {
+                                  "bootDiagnostics": {
+                                    "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
+                                    "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
+                                  }
+                                },
+                                "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
+                                "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
+                                "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
+                                "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
+                                "priority": "[parameters('priority')]",
+                                "evictionPolicy": "[if(parameters('enableEvictionPolicy'), 'Deallocate', null())]",
+                                "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
+                                "host": "[if(not(empty(parameters('dedicatedHostId'))), createObject('id', parameters('dedicatedHostId')), null())]",
+                                "licenseType": "[if(not(empty(parameters('licenseType'))), parameters('licenseType'), null())]"
+                              },
+                              "dependsOn": [
+                                "vm_nic"
+                              ]
+                            },
+                            "vm_configurationAssignment": {
+                              "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
+                              "type": "Microsoft.Maintenance/configurationAssignments",
+                              "apiVersion": "2023-04-01",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "[format('{0}assignment', parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
+                                "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_configurationProfileAssignment": {
+                              "condition": "[not(empty(parameters('configurationProfile')))]",
+                              "type": "Microsoft.Automanage/configurationProfileAssignments",
+                              "apiVersion": "2022-05-04",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "default",
+                              "properties": {
+                                "configurationProfile": "[parameters('configurationProfile')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_autoShutdownConfiguration": {
+                              "condition": "[not(empty(parameters('autoShutdownConfig')))]",
+                              "type": "Microsoft.DevTestLab/schedules",
+                              "apiVersion": "2018-09-15",
+                              "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "status": "[if(contains(parameters('autoShutdownConfig'), 'status'), parameters('autoShutdownConfig').status, 'Disabled')]",
+                                "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                                "taskType": "ComputeVmShutdownTask",
+                                "dailyRecurrence": {
+                                  "time": "[if(contains(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), parameters('autoShutdownConfig').dailyRecurrenceTime, '19:00')]"
+                                },
+                                "timeZoneId": "[if(contains(parameters('autoShutdownConfig'), 'timeZone'), parameters('autoShutdownConfig').timeZone, 'UTC')]",
+                                "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), createObject('status', if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), parameters('autoShutdownConfig').notificationStatus, 'Disabled'), 'emailRecipient', if(contains(parameters('autoShutdownConfig'), 'notificationEmail'), parameters('autoShutdownConfig').notificationEmail, ''), 'notificationLocale', if(contains(parameters('autoShutdownConfig'), 'notificationLocale'), parameters('autoShutdownConfig').notificationLocale, 'en'), 'webhookUrl', if(contains(parameters('autoShutdownConfig'), 'notificationWebhookUrl'), parameters('autoShutdownConfig').notificationWebhookUrl, ''), 'timeInMinutes', if(contains(parameters('autoShutdownConfig'), 'notificationTimeInMinutes'), parameters('autoShutdownConfig').notificationTimeInMinutes, 30)), null())]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_logAnalyticsWorkspace": {
+                              "condition": "[not(empty(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2021-06-01",
+                              "subscriptionId": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2]]",
+                              "resourceGroup": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]]",
+                              "name": "[last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))]"
+                            },
+                            "AzureWindowsBaseline": {
+                              "condition": "[not(empty(parameters('guestConfiguration')))]",
+                              "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
+                              "apiVersion": "2020-06-25",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "AzureWindowsBaseline",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "guestConfiguration": "[parameters('guestConfiguration')]"
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureGuestConfigurationExtension"
+                              ]
+                            },
+                            "vm_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_roleAssignments": {
+                              "copy": {
+                                "name": "vm_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_nic": {
+                              "copy": {
+                                "name": "vm_nic",
+                                "count": "[length(parameters('nicConfigurations'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "networkInterfaceName": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'name'), createObject('value', parameters('nicConfigurations')[copyIndex()].name), createObject('value', format('{0}{1}', parameters('name'), parameters('nicConfigurations')[copyIndex()].nicSuffix)))]",
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableIPForwarding": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), createObject('value', parameters('nicConfigurations')[copyIndex()].enableIPForwarding), createObject('value', false()))]",
+                                  "enableAcceleratedNetworking": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), createObject('value', parameters('nicConfigurations')[copyIndex()].enableAcceleratedNetworking), createObject('value', true()))]",
+                                  "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(parameters('nicConfigurations')[copyIndex()].dnsServers)), createObject('value', parameters('nicConfigurations')[copyIndex()].dnsServers), createObject('value', createArray())), createObject('value', createArray()))]",
+                                  "networkSecurityGroupResourceId": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), createObject('value', parameters('nicConfigurations')[copyIndex()].networkSecurityGroupResourceId), createObject('value', ''))]",
+                                  "ipConfigurations": {
+                                    "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "6185170122493883924"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "diagnosticSettingType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of diagnostic setting."
+                                            }
+                                          },
+                                          "logCategoriesAndGroups": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "category": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                  }
+                                                },
+                                                "categoryGroup": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                  }
+                                                },
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                            }
+                                          },
+                                          "metricCategories": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "category": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                  }
+                                                },
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                            }
+                                          },
+                                          "logAnalyticsDestinationType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "AzureDiagnostics",
+                                              "Dedicated"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                            }
+                                          },
+                                          "workspaceResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                            }
+                                          },
+                                          "storageAccountResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                            }
+                                          },
+                                          "eventHubAuthorizationRuleResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                            }
+                                          },
+                                          "eventHubName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                            }
+                                          },
+                                          "marketplacePartnerResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "networkInterfaceName": {
+                                      "type": "string"
+                                    },
+                                    "virtualMachineName": {
+                                      "type": "string"
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "enableIPForwarding": {
+                                      "type": "bool",
+                                      "defaultValue": false
+                                    },
+                                    "enableAcceleratedNetworking": {
+                                      "type": "bool",
+                                      "defaultValue": false
+                                    },
+                                    "dnsServers": {
+                                      "type": "array",
+                                      "defaultValue": []
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
+                                      }
+                                    },
+                                    "networkSecurityGroupResourceId": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "$ref": "#/definitions/diagnosticSettingType",
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the Network Interface."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "networkInterface_publicIPAddresses": {
+                                      "copy": {
+                                        "name": "networkInterface_publicIPAddresses",
+                                        "count": "[length(parameters('ipConfigurations'))]"
+                                      },
+                                      "condition": "[contains(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'name'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.name), createObject('value', format('{0}{1}', parameters('virtualMachineName'), parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIpNameSuffix)))]",
+                                          "diagnosticSettings": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "lock": {
+                                            "value": "[parameters('lock')]"
+                                          },
+                                          "idleTimeoutInMinutes": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'idleTimeoutInMinutes')]"
+                                          },
+                                          "ddosSettings": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'ddosSettings')]"
+                                          },
+                                          "dnsSettings": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'dnsSettings')]"
+                                          },
+                                          "publicIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressVersion'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPAddressVersion), createObject('value', 'IPv4'))]",
+                                          "publicIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAllocationMethod'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPAllocationMethod), createObject('value', 'Static'))]",
+                                          "publicIpPrefixResourceId": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPPrefixResourceId'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPPrefixResourceId), createObject('value', ''))]",
+                                          "roleAssignments": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'roleAssignments'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.roleAssignments), createObject('value', createArray()))]",
+                                          "skuName": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuName'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.skuName), createObject('value', 'Standard'))]",
+                                          "skuTier": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuTier'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.skuTier), createObject('value', 'Regional'))]",
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "zones": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'zones'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.zones), createObject('value', createArray(1, 2, 3)))]",
+                                          "enableTelemetry": {
+                                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.27.1.19265",
+                                              "templateHash": "10356333973104369631"
+                                            },
+                                            "name": "Public IP Addresses",
+                                            "description": "This module deploys a Public IP Address.",
+                                            "owner": "Azure/module-maintainers"
+                                          },
+                                          "definitions": {
+                                            "roleAssignmentType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "roleDefinitionIdOrName": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                    }
+                                                  },
+                                                  "principalId": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                    }
+                                                  },
+                                                  "principalType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Device",
+                                                      "ForeignGroup",
+                                                      "Group",
+                                                      "ServicePrincipal",
+                                                      "User"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The principal type of the assigned principal ID."
+                                                    }
+                                                  },
+                                                  "description": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The description of the role assignment."
+                                                    }
+                                                  },
+                                                  "condition": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                    }
+                                                  },
+                                                  "conditionVersion": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "2.0"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Version of the condition."
+                                                    }
+                                                  },
+                                                  "delegatedManagedIdentityResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "dnsSettingsType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "domainNameLabel": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                                  }
+                                                },
+                                                "domainNameLabelScope": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "",
+                                                    "NoReuse",
+                                                    "ResourceGroupReuse",
+                                                    "SubscriptionReuse",
+                                                    "TenantReuse"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                                  }
+                                                },
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                                  }
+                                                },
+                                                "reverseFqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "ddosSettingsType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "ddosProtectionPlan": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "id": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                                  }
+                                                },
+                                                "protectionMode": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Enabled"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. The DDoS protection policy customizations."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "diagnosticSettingType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of diagnostic setting."
+                                                    }
+                                                  },
+                                                  "logCategoriesAndGroups": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                          }
+                                                        },
+                                                        "categoryGroup": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                    }
+                                                  },
+                                                  "metricCategories": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                    }
+                                                  },
+                                                  "logAnalyticsDestinationType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "AzureDiagnostics",
+                                                      "Dedicated"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                    }
+                                                  },
+                                                  "workspaceResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "storageAccountResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "eventHubAuthorizationRuleResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                    }
+                                                  },
+                                                  "eventHubName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "marketplacePartnerResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Public IP Address."
+                                              }
+                                            },
+                                            "publicIpPrefixResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                              }
+                                            },
+                                            "publicIPAllocationMethod": {
+                                              "type": "string",
+                                              "defaultValue": "Static",
+                                              "allowedValues": [
+                                                "Dynamic",
+                                                "Static"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The public IP address allocation method."
+                                              }
+                                            },
+                                            "zones": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "int"
+                                              },
+                                              "defaultValue": [
+                                                1,
+                                                2,
+                                                3
+                                              ],
+                                              "allowedValues": [
+                                                1,
+                                                2,
+                                                3
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                                              }
+                                            },
+                                            "publicIPAddressVersion": {
+                                              "type": "string",
+                                              "defaultValue": "IPv4",
+                                              "allowedValues": [
+                                                "IPv4",
+                                                "IPv6"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. IP address version."
+                                              }
+                                            },
+                                            "dnsSettings": {
+                                              "$ref": "#/definitions/dnsSettingsType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The DNS settings of the public IP address."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "skuName": {
+                                              "type": "string",
+                                              "defaultValue": "Standard",
+                                              "allowedValues": [
+                                                "Basic",
+                                                "Standard"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Name of a public IP address SKU."
+                                              }
+                                            },
+                                            "skuTier": {
+                                              "type": "string",
+                                              "defaultValue": "Regional",
+                                              "allowedValues": [
+                                                "Global",
+                                                "Regional"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Tier of a public IP address SKU."
+                                              }
+                                            },
+                                            "ddosSettings": {
+                                              "$ref": "#/definitions/ddosSettingsType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "$ref": "#/definitions/roleAssignmentType",
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "idleTimeoutInMinutes": {
+                                              "type": "int",
+                                              "defaultValue": 4,
+                                              "metadata": {
+                                                "description": "Optional. The idle timeout of the public IP address."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags of the resource."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "$ref": "#/definitions/diagnosticSettingType",
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2023-07-01",
+                                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "publicIpAddress": {
+                                              "type": "Microsoft.Network/publicIPAddresses",
+                                              "apiVersion": "2023-09-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "sku": {
+                                                "name": "[parameters('skuName')]",
+                                                "tier": "[parameters('skuTier')]"
+                                              },
+                                              "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                                              "properties": {
+                                                "ddosSettings": "[parameters('ddosSettings')]",
+                                                "dnsSettings": "[parameters('dnsSettings')]",
+                                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                                "ipTags": null
+                                              }
+                                            },
+                                            "publicIpAddress_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            },
+                                            "publicIpAddress_roleAssignments": {
+                                              "copy": {
+                                                "name": "publicIpAddress_roleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                              "properties": {
+                                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            },
+                                            "publicIpAddress_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "publicIpAddress_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the public IP address was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the public IP address."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the public IP address."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                                            },
+                                            "ipAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The public IP address of the public IP address resource."
+                                              },
+                                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "networkInterface": {
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-NetworkInterface', deployment().name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[parameters('networkInterfaceName')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "copy": [
+                                              {
+                                                "name": "value",
+                                                "count": "[length(parameters('ipConfigurations'))]",
+                                                "input": "[createObject('name', if(not(empty(parameters('ipConfigurations')[copyIndex('value')].name)), parameters('ipConfigurations')[copyIndex('value')].name, null()), 'primary', equals(copyIndex('value'), 0), 'privateIPAllocationMethod', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod, null()), null()), 'privateIPAddress', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('value')].privateIPAddress, null()), null()), 'publicIPAddressResourceId', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), resourceId('Microsoft.Network/publicIPAddresses', if(contains(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'name'), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.name, format('{0}{1}', parameters('virtualMachineName'), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.publicIpNameSuffix))), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('value')].loadBalancerBackendAddressPools, null()), 'applicationSecurityGroups', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('value')].applicationSecurityGroups, null()), 'applicationGatewayBackendAddressPools', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('value')].applicationGatewayBackendAddressPools, null()), 'gatewayLoadBalancer', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('value')].gatewayLoadBalancer, null()), 'loadBalancerInboundNatRules', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('value')].loadBalancerInboundNatRules, null()), 'privateIPAddressVersion', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('value')].privateIPAddressVersion, null()), 'virtualNetworkTaps', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('value')].virtualNetworkTaps, null()))]"
+                                              }
+                                            ]
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "tags": {
+                                            "value": "[parameters('tags')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[parameters('diagnosticSettings')]"
+                                          },
+                                          "dnsServers": "[if(not(empty(parameters('dnsServers'))), createObject('value', parameters('dnsServers')), createObject('value', createArray()))]",
+                                          "enableAcceleratedNetworking": {
+                                            "value": "[parameters('enableAcceleratedNetworking')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[parameters('enableTelemetry')]"
+                                          },
+                                          "enableIPForwarding": {
+                                            "value": "[parameters('enableIPForwarding')]"
+                                          },
+                                          "lock": {
+                                            "value": "[parameters('lock')]"
+                                          },
+                                          "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
+                                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.25.53.49325",
+                                              "templateHash": "1612343535299711142"
+                                            },
+                                            "name": "Network Interface",
+                                            "description": "This module deploys a Network Interface.",
+                                            "owner": "Azure/module-maintainers"
+                                          },
+                                          "definitions": {
+                                            "diagnosticSettingType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of diagnostic setting."
+                                                    }
+                                                  },
+                                                  "logCategoriesAndGroups": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                          }
+                                                        },
+                                                        "categoryGroup": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                    }
+                                                  },
+                                                  "metricCategories": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                    }
+                                                  },
+                                                  "logAnalyticsDestinationType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "AzureDiagnostics",
+                                                      "Dedicated"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                    }
+                                                  },
+                                                  "workspaceResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "storageAccountResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "eventHubAuthorizationRuleResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                    }
+                                                  },
+                                                  "eventHubName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "marketplacePartnerResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "roleDefinitionIdOrName": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                    }
+                                                  },
+                                                  "principalId": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                    }
+                                                  },
+                                                  "principalType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Device",
+                                                      "ForeignGroup",
+                                                      "Group",
+                                                      "ServicePrincipal",
+                                                      "User"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The principal type of the assigned principal ID."
+                                                    }
+                                                  },
+                                                  "description": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The description of the role assignment."
+                                                    }
+                                                  },
+                                                  "condition": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                    }
+                                                  },
+                                                  "conditionVersion": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "2.0"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Version of the condition."
+                                                    }
+                                                  },
+                                                  "delegatedManagedIdentityResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the network interface."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource tags."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "enableIPForwarding": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                                              }
+                                            },
+                                            "enableAcceleratedNetworking": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. If the network interface is accelerated networking enabled."
+                                              }
+                                            },
+                                            "dnsServers": {
+                                              "type": "array",
+                                              "defaultValue": [],
+                                              "metadata": {
+                                                "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                                              }
+                                            },
+                                            "networkSecurityGroupResourceId": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                              }
+                                            },
+                                            "auxiliaryMode": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "Floating",
+                                                "MaxConnections",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                              }
+                                            },
+                                            "auxiliarySku": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "A1",
+                                                "A2",
+                                                "A4",
+                                                "A8",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                              }
+                                            },
+                                            "disableTcpStateTracking": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "description": "Required. A list of IPConfigurations of the network interface."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "$ref": "#/definitions/roleAssignmentType",
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "$ref": "#/definitions/diagnosticSettingType",
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2023-07-01",
+                                              "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.2.4', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "networkInterface": {
+                                              "type": "Microsoft.Network/networkInterfaces",
+                                              "apiVersion": "2023-04-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "ipConfigurations",
+                                                    "count": "[length(parameters('ipConfigurations'))]",
+                                                    "input": {
+                                                      "name": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].name, format('ipconfig0{0}', add(copyIndex('ipConfigurations'), 1)))]",
+                                                      "properties": {
+                                                        "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
+                                                        "privateIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod, null()), null())]",
+                                                        "privateIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress, null()), null())]",
+                                                        "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId, null())), createObject('id', parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId), null()), null())]",
+                                                        "subnet": {
+                                                          "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
+                                                        },
+                                                        "loadBalancerBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerBackendAddressPools, null())]",
+                                                        "applicationSecurityGroups": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationSecurityGroups, null())]",
+                                                        "applicationGatewayBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationGatewayBackendAddressPools, null())]",
+                                                        "gatewayLoadBalancer": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].gatewayLoadBalancer, null())]",
+                                                        "loadBalancerInboundNatRules": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerInboundNatRules, null())]",
+                                                        "privateIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddressVersion, null())]",
+                                                        "virtualNetworkTaps": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].virtualNetworkTaps, null())]"
+                                                      }
+                                                    }
+                                                  }
+                                                ],
+                                                "auxiliaryMode": "[parameters('auxiliaryMode')]",
+                                                "auxiliarySku": "[parameters('auxiliarySku')]",
+                                                "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
+                                                "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
+                                                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
+                                                "enableIPForwarding": "[parameters('enableIPForwarding')]",
+                                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
+                                              }
+                                            },
+                                            "networkInterface_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            },
+                                            "networkInterface_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "networkInterface_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            },
+                                            "networkInterface_roleAssignments": {
+                                              "copy": {
+                                                "name": "networkInterface_roleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                              "properties": {
+                                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed resource."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed resource."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed resource."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('networkInterface', '2023-04-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "networkInterface_publicIPAddresses"
+                                      ]
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "vm_aadJoinExtension": {
+                              "condition": "[parameters('extensionAadJoinConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "AADLogin"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.ActiveDirectory"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAadJoinConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '2.0'), createObject('value', '1.0')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAadJoinConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAadJoinConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": "[if(contains(parameters('extensionAadJoinConfig'), 'settings'), createObject('value', parameters('extensionAadJoinConfig').settings), createObject('value', createObject()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_domainJoinExtension": {
+                              "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "DomainJoin"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Compute"
+                                  },
+                                  "type": {
+                                    "value": "JsonADDomainExtension"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDomainJoinConfig').typeHandlerVersion), createObject('value', '1.3'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDomainJoinConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDomainJoinConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": "[parameters('extensionDomainJoinConfig').settings]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": {
+                                      "Password": "[parameters('extensionDomainJoinPassword')]"
+                                    }
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_aadJoinExtension"
+                              ]
+                            },
+                            "vm_microsoftAntiMalwareExtension": {
+                              "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "MicrosoftAntiMalware"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Security"
+                                  },
+                                  "type": {
+                                    "value": "IaaSAntimalware"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAntiMalwareConfig').typeHandlerVersion), createObject('value', '1.3'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAntiMalwareConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAntiMalwareConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": "[parameters('extensionAntiMalwareConfig').settings]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_domainJoinExtension"
+                              ]
+                            },
+                            "vm_azureMonitorAgentExtension": {
+                              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "AzureMonitorAgent"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Monitor"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": {
+                                      "workspaceId": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), reference('vm_logAnalyticsWorkspace').customerId, '')]",
+                                      "GCS_AUTO_CONFIG": "[if(equals(parameters('osType'), 'Linux'), true(), null())]"
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": {
+                                      "workspaceKey": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2], split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))), '2021-06-01').primarySharedKey, '')]"
+                                    }
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_logAnalyticsWorkspace",
+                                "vm_microsoftAntiMalwareExtension"
+                              ]
+                            },
+                            "vm_dependencyAgentExtension": {
+                              "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "DependencyAgent"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Monitoring.DependencyAgent"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDependencyAgentConfig').typeHandlerVersion), createObject('value', '9.10'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDependencyAgentConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDependencyAgentConfig').enableAutomaticUpgrade), createObject('value', true()))]",
+                                  "settings": {
+                                    "value": {
+                                      "enableAMA": "[if(contains(parameters('extensionDependencyAgentConfig'), 'enableAMA'), parameters('extensionDependencyAgentConfig').enableAMA, true())]"
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureMonitorAgentExtension"
+                              ]
+                            },
+                            "vm_networkWatcherAgentExtension": {
+                              "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "NetworkWatcherAgent"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.NetworkWatcher"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').typeHandlerVersion), createObject('value', '1.4'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_dependencyAgentExtension"
+                              ]
+                            },
+                            "vm_desiredStateConfigurationExtension": {
+                              "condition": "[parameters('extensionDSCConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "DesiredStateConfiguration"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Powershell"
+                                  },
+                                  "type": {
+                                    "value": "DSC"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionDSCConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDSCConfig').typeHandlerVersion), createObject('value', '2.77'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDSCConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDSCConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": "[if(contains(parameters('extensionDSCConfig'), 'settings'), createObject('value', parameters('extensionDSCConfig').settings), createObject('value', createObject()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": "[if(contains(parameters('extensionDSCConfig'), 'protectedSettings'), createObject('value', parameters('extensionDSCConfig').protectedSettings), createObject('value', createObject()))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_networkWatcherAgentExtension"
+                              ]
+                            },
+                            "vm_customScriptExtension": {
+                              "condition": "[parameters('extensionCustomScriptConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "CustomScriptExtension"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionCustomScriptConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '1.10'), createObject('value', '2.1')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionCustomScriptConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionCustomScriptConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": {
+                                      "copy": [
+                                        {
+                                          "name": "fileUris",
+                                          "count": "[length(parameters('extensionCustomScriptConfig').fileData)]",
+                                          "input": "[if(contains(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')], 'storageAccountId'), format('{0}?{1}', parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri, listAccountSas(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].storageAccountId, '2019-04-01', variables('accountSasProperties')).accountSasToken), parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri)]"
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[parameters('extensionCustomScriptProtectedSetting')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_desiredStateConfigurationExtension"
+                              ]
+                            },
+                            "vm_azureDiskEncryptionExtension": {
+                              "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "AzureDiskEncryption"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Security"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '2.2'), createObject('value', '1.1')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "forceUpdateTag": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').forceUpdateTag), createObject('value', '1.0'))]",
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_customScriptExtension"
+                              ]
+                            },
+                            "vm_nvidiaGpuDriverWindowsExtension": {
+                              "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "NvidiaGpuDriverWindows"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.HpcCompute"
+                                  },
+                                  "type": {
+                                    "value": "NvidiaGpuDriverWindows"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').typeHandlerVersion), createObject('value', '1.4'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureDiskEncryptionExtension"
+                              ]
+                            },
+                            "vm_hostPoolRegistrationExtension": {
+                              "condition": "[parameters('extensionHostPoolRegistration').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "HostPoolRegistration"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.PowerShell"
+                                  },
+                                  "type": {
+                                    "value": "DSC"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), createObject('value', parameters('extensionHostPoolRegistration').typeHandlerVersion), createObject('value', '2.77'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionHostPoolRegistration').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionHostPoolRegistration').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": {
+                                      "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
+                                      "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
+                                      "properties": {
+                                        "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
+                                        "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]",
+                                        "aadJoin": true
+                                      },
+                                      "supressFailures": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
+                                    }
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_nvidiaGpuDriverWindowsExtension"
+                              ]
+                            },
+                            "vm_azureGuestConfigurationExtension": {
+                              "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.GuestConfiguration"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), createObject('value', parameters('extensionGuestConfigurationExtension').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '1.0'), createObject('value', '1.0')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionGuestConfigurationExtension').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionGuestConfigurationExtension').enableAutomaticUpgrade), createObject('value', true()))]",
+                                  "forceUpdateTag": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), createObject('value', parameters('extensionGuestConfigurationExtension').forceUpdateTag), createObject('value', '1.0'))]",
+                                  "settings": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject('value', parameters('extensionGuestConfigurationExtension').settings), createObject('value', createObject()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_hostPoolRegistrationExtension"
+                              ]
+                            },
+                            "vm_backup": {
+                              "condition": "[not(empty(parameters('backupVaultName')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
+                              "resourceGroup": "[parameters('backupVaultResourceGroup')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "policyId": {
+                                    "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
+                                  },
+                                  "protectedItemType": {
+                                    "value": "Microsoft.Compute/virtualMachines"
+                                  },
+                                  "protectionContainerName": {
+                                    "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                                  },
+                                  "recoveryVaultName": {
+                                    "value": "[parameters('backupVaultName')]"
+                                  },
+                                  "sourceResourceId": {
+                                    "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "4311417160342913977"
+                                    },
+                                    "name": "Recovery Service Vaults Protection Container Protected Item",
+                                    "description": "This module deploys a Recovery Services Vault Protection Container Protected Item.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the resource."
+                                      }
+                                    },
+                                    "protectionContainerName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "recoveryVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "protectedItemType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureFileShareProtectedItem",
+                                        "AzureVmWorkloadSAPAseDatabase",
+                                        "AzureVmWorkloadSAPHanaDatabase",
+                                        "AzureVmWorkloadSQLDatabase",
+                                        "DPMProtectedItem",
+                                        "GenericProtectedItem",
+                                        "MabFileFolderProtectedItem",
+                                        "Microsoft.ClassicCompute/virtualMachines",
+                                        "Microsoft.Compute/virtualMachines",
+                                        "Microsoft.Sql/servers/databases"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The backup item type."
+                                      }
+                                    },
+                                    "policyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. ID of the backup policy with which this item is backed up."
+                                      }
+                                    },
+                                    "sourceResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the resource to back up."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
+                                      "apiVersion": "2023-01-01",
+                                      "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "protectedItemType": "[parameters('protectedItemType')]",
+                                        "policyId": "[parameters('policyId')]",
+                                        "sourceResourceId": "[parameters('sourceResourceId')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the protected item was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the protected item."
+                                      },
+                                      "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The Name of the protected item."
+                                      },
+                                      "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureGuestConfigurationExtension"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the VM."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the VM."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the VM was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(reference('vm', '2023-09-01', 'full'), 'identity'), 'principalId'), '')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('vm', '2023-09-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', format('dep-mc-{0}', parameters('vmName')))]",
+                        "[resourceId('Microsoft.Network/virtualNetworks/subnets', split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[0], split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[1])]"
+                      ]
+                    }
+                  ]
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "An optional Linux virtual machine deployment to act as a jump box."
+              }
+            },
+            {
+              "condition": "[equals(parameters('vmJumpboxOSType'), 'windows')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('vm-windows-{0}', deployment().name), 64)]",
+              "resourceGroup": "[variables('rgSpokeName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "vmName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBox]"
+                  },
+                  "bastionResourceId": {
+                    "value": "[parameters('bastionResourceId')]"
+                  },
+                  "vmAdminUsername": {
+                    "value": "[parameters('vmAdminUsername')]"
+                  },
+                  "vmAdminPassword": {
+                    "value": "[parameters('vmAdminPassword')]"
+                  },
+                  "vmSize": {
+                    "value": "[parameters('vmSize')]"
+                  },
+                  "vmZone": {
+                    "value": "[parameters('vmZone')]"
+                  },
+                  "storageAccountType": {
+                    "value": "[parameters('storageAccountType')]"
+                  },
+                  "vmVnetName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64)), '2022-09-01').outputs.name.value]"
+                  },
+                  "vmSubnetName": {
+                    "value": "[parameters('vmSubnetName')]"
+                  },
+                  "vmSubnetAddressPrefix": {
+                    "value": "[parameters('vmJumpBoxSubnetAddressPrefix')]"
+                  },
+                  "vmNetworkInterfaceName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBoxNic]"
+                  },
+                  "vmNetworkSecurityGroupName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBoxNsg]"
+                  },
+                  "logAnalyticsWorkspaceResourceId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "8661291685866182643"
+                    }
+                  },
+                  "parameters": {
+                    "vmName": {
+                      "type": "string"
+                    },
+                    "vmSize": {
+                      "type": "string"
+                    },
+                    "storageAccountType": {
+                      "type": "string",
+                      "defaultValue": "Standard_LRS"
+                    },
+                    "vmWindowsOSVersion": {
+                      "type": "string",
+                      "defaultValue": "2016-Datacenter"
+                    },
+                    "vmZone": {
+                      "type": "int",
+                      "defaultValue": 0
+                    },
+                    "vmVnetName": {
+                      "type": "string"
+                    },
+                    "vmSubnetName": {
+                      "type": "string"
+                    },
+                    "vmSubnetAddressPrefix": {
+                      "type": "string"
+                    },
+                    "vmNetworkSecurityGroupName": {
+                      "type": "string"
+                    },
+                    "vmNetworkInterfaceName": {
+                      "type": "string"
+                    },
+                    "logAnalyticsWorkspaceResourceId": {
+                      "type": "string"
+                    },
+                    "bastionResourceId": {
+                      "type": "string"
+                    },
+                    "vmAdminUsername": {
+                      "type": "string"
+                    },
+                    "vmAdminPassword": {
+                      "type": "securestring"
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The tags to be assigned to the created resources."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Whether to enable deplotment telemetry."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]"
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Network/virtualNetworks/subnets",
+                      "apiVersion": "2023-11-01",
+                      "name": "[format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName'))]",
+                      "properties": {
+                        "addressPrefix": "[parameters('vmSubnetAddressPrefix')]",
+                        "networkSecurityGroup": {
+                          "id": "[reference(resourceId('Microsoft.Resources/deployments', 'vmNetworkSecurityDeployment'), '2022-09-01').outputs.resourceId.value]"
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Resources/deployments', 'vmNetworkSecurityDeployment')]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Maintenance/maintenanceConfigurations",
+                      "apiVersion": "2023-10-01-preview",
+                      "name": "[format('dep-mc-{0}', parameters('vmName'))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "extensionProperties": {
+                          "InGuestPatchMode": "User"
+                        },
+                        "maintenanceScope": "InGuestPatch",
+                        "maintenanceWindow": {
+                          "startDateTime": "2024-06-16 00:00",
+                          "duration": "03:55",
+                          "timeZone": "W. Europe Standard Time",
+                          "recurEvery": "1Day"
+                        },
+                        "visibility": "Custom",
+                        "installPatches": {
+                          "rebootSetting": "IfRequired",
+                          "windowsParameters": {
+                            "classificationsToInclude": [
+                              "Critical",
+                              "Security"
+                            ]
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "vmNetworkSecurityDeployment",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('vmNetworkSecurityGroupName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "securityRules": "[if(not(empty(parameters('bastionResourceId'))), createObject('value', createArray(createObject('name', 'allow-bastion-inbound', 'properties', createObject('description', 'Allow inbound traffic from Bastion to the JumpBox', 'protocol', '*', 'sourceAddressPrefix', 'Bastion', 'sourcePortRange', '*', 'destinationAddressPrefix', '*', 'destinationPortRange', '*', 'access', 'Allow', 'priority', 100, 'direction', 'Inbound')))), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "8543584719514494080"
+                            },
+                            "name": "Network Security Groups",
+                            "description": "This module deploys a Network security Group (NSG).",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Network Security Group."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "securityRules": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                              }
+                            },
+                            "flushConnection": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the NSG resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.2.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "networkSecurityGroup": {
+                              "type": "Microsoft.Network/networkSecurityGroups",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "securityRules",
+                                    "count": "[length(parameters('securityRules'))]",
+                                    "input": {
+                                      "name": "[parameters('securityRules')[copyIndex('securityRules')].name]",
+                                      "properties": {
+                                        "protocol": "[parameters('securityRules')[copyIndex('securityRules')].properties.protocol]",
+                                        "access": "[parameters('securityRules')[copyIndex('securityRules')].properties.access]",
+                                        "priority": "[parameters('securityRules')[copyIndex('securityRules')].properties.priority]",
+                                        "direction": "[parameters('securityRules')[copyIndex('securityRules')].properties.direction]",
+                                        "description": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'description'), parameters('securityRules')[copyIndex('securityRules')].properties.description, '')]",
+                                        "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRange, '')]",
+                                        "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourcePortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.sourcePortRanges, createArray())]",
+                                        "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRange'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRange, '')]",
+                                        "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationPortRanges'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationPortRanges, createArray())]",
+                                        "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefix, '')]",
+                                        "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefix, '')]",
+                                        "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceAddressPrefixes, createArray())]",
+                                        "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationAddressPrefixes, createArray())]",
+                                        "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.sourceApplicationSecurityGroups, createArray())]",
+                                        "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroups'), parameters('securityRules')[copyIndex('securityRules')].properties.destinationApplicationSecurityGroups, createArray())]"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "flushConnection": "[parameters('flushConnection')]"
+                              }
+                            },
+                            "networkSecurityGroup_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_diagnosticSettings": {
+                              "copy": {
+                                "name": "networkSecurityGroup_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_roleAssignments": {
+                              "copy": {
+                                "name": "networkSecurityGroup_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_securityRules": {
+                              "copy": {
+                                "name": "networkSecurityGroup_securityRules",
+                                "count": "[length(parameters('securityRules'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-NetworkSecurityGroup-SecurityRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('securityRules')[copyIndex()].name]"
+                                  },
+                                  "networkSecurityGroupName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "protocol": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.protocol]"
+                                  },
+                                  "access": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.access]"
+                                  },
+                                  "priority": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.priority]"
+                                  },
+                                  "direction": {
+                                    "value": "[parameters('securityRules')[copyIndex()].properties.direction]"
+                                  },
+                                  "description": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'description'), createObject('value', parameters('securityRules')[copyIndex()].properties.description), createObject('value', ''))]",
+                                  "sourcePortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRange), createObject('value', ''))]",
+                                  "sourcePortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourcePortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourcePortRanges), createObject('value', createArray()))]",
+                                  "destinationPortRange": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRange'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRange), createObject('value', ''))]",
+                                  "destinationPortRanges": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationPortRanges'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationPortRanges), createObject('value', createArray()))]",
+                                  "sourceAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefix), createObject('value', ''))]",
+                                  "destinationAddressPrefix": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefix'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefix), createObject('value', ''))]",
+                                  "sourceAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceAddressPrefixes), createObject('value', createArray()))]",
+                                  "destinationAddressPrefixes": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationAddressPrefixes'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationAddressPrefixes), createObject('value', createArray()))]",
+                                  "sourceApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'sourceApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.sourceApplicationSecurityGroups), createObject('value', createArray()))]",
+                                  "destinationApplicationSecurityGroups": "[if(contains(parameters('securityRules')[copyIndex()].properties, 'destinationApplicationSecurityGroups'), createObject('value', parameters('securityRules')[copyIndex()].properties.destinationApplicationSecurityGroups), createObject('value', createArray()))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "17252857850318600622"
+                                    },
+                                    "name": "Network Security Group (NSG) Security Rules",
+                                    "description": "This module deploys a Network Security Group (NSG) Security Rule.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the security rule."
+                                      }
+                                    },
+                                    "networkSecurityGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent network security group to deploy the security rule into. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "access": {
+                                      "type": "string",
+                                      "defaultValue": "Deny",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether network traffic is allowed or denied."
+                                      }
+                                    },
+                                    "description": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "maxLength": 140,
+                                      "metadata": {
+                                        "description": "Optional. A description for this rule."
+                                      }
+                                    },
+                                    "destinationAddressPrefix": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                                      }
+                                    },
+                                    "destinationAddressPrefixes": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                                      }
+                                    },
+                                    "destinationApplicationSecurityGroups": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The application security group specified as destination."
+                                      }
+                                    },
+                                    "destinationPortRange": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                                      }
+                                    },
+                                    "destinationPortRanges": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The destination port ranges."
+                                      }
+                                    },
+                                    "direction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Inbound",
+                                        "Outbound"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                                      }
+                                    },
+                                    "priority": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                                      }
+                                    },
+                                    "protocol": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "*",
+                                        "Ah",
+                                        "Esp",
+                                        "Icmp",
+                                        "Tcp",
+                                        "Udp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Network protocol this rule applies to."
+                                      }
+                                    },
+                                    "sourceAddressPrefix": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                                      }
+                                    },
+                                    "sourceAddressPrefixes": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The CIDR or source IP ranges."
+                                      }
+                                    },
+                                    "sourceApplicationSecurityGroups": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The application security group specified as source."
+                                      }
+                                    },
+                                    "sourcePortRange": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                                      }
+                                    },
+                                    "sourcePortRanges": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The source port ranges."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
+                                      "apiVersion": "2023-11-01",
+                                      "name": "[format('{0}/{1}', parameters('networkSecurityGroupName'), parameters('name'))]",
+                                      "properties": {
+                                        "access": "[parameters('access')]",
+                                        "description": "[parameters('description')]",
+                                        "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
+                                        "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]",
+                                        "destinationApplicationSecurityGroups": "[parameters('destinationApplicationSecurityGroups')]",
+                                        "destinationPortRange": "[parameters('destinationPortRange')]",
+                                        "destinationPortRanges": "[parameters('destinationPortRanges')]",
+                                        "direction": "[parameters('direction')]",
+                                        "priority": "[parameters('priority')]",
+                                        "protocol": "[parameters('protocol')]",
+                                        "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
+                                        "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
+                                        "sourceApplicationSecurityGroups": "[parameters('sourceApplicationSecurityGroups')]",
+                                        "sourcePortRange": "[parameters('sourcePortRange')]",
+                                        "sourcePortRanges": "[parameters('sourcePortRanges')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the security rule was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the security rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups/securityRules', parameters('networkSecurityGroupName'), parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the security rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the network security group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the network security group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the network security group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "vmDeployment",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('vmName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "osType": {
+                            "value": "Windows"
+                          },
+                          "computerName": {
+                            "value": "[parameters('vmName')]"
+                          },
+                          "adminUsername": {
+                            "value": "[parameters('vmAdminUsername')]"
+                          },
+                          "adminPassword": {
+                            "value": "[parameters('vmAdminPassword')]"
+                          },
+                          "encryptionAtHost": {
+                            "value": false
+                          },
+                          "enableAutomaticUpdates": {
+                            "value": true
+                          },
+                          "patchMode": {
+                            "value": "AutomaticByPlatform"
+                          },
+                          "bypassPlatformSafetyChecksOnUserSchedule": {
+                            "value": true
+                          },
+                          "maintenanceConfigurationResourceId": {
+                            "value": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', format('dep-mc-{0}', parameters('vmName')))]"
+                          },
+                          "nicConfigurations": {
+                            "value": [
+                              {
+                                "name": "[parameters('vmNetworkInterfaceName')]",
+                                "enableAcceleratedNetworking": false,
+                                "ipConfigurations": [
+                                  {
+                                    "name": "ipconfig1",
+                                    "privateIPAllocationMethod": "Dynamic",
+                                    "subnetResourceId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[0], split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[1])]"
+                                  }
+                                ]
+                              }
+                            ]
+                          },
+                          "osDisk": {
+                            "value": {
+                              "caching": "ReadWrite",
+                              "createOption": "FromImage",
+                              "deleteOption": "Delete",
+                              "diskSizeGB": 128,
+                              "managedDisk": {
+                                "storageAccountType": "[parameters('storageAccountType')]"
+                              }
+                            }
+                          },
+                          "zone": {
+                            "value": "[parameters('vmZone')]"
+                          },
+                          "vmSize": {
+                            "value": "[parameters('vmSize')]"
+                          },
+                          "imageReference": {
+                            "value": {
+                              "publisher": "MicrosoftWindowsServer",
+                              "offer": "WindowsServer",
+                              "sku": "[parameters('vmWindowsOSVersion')]",
+                              "version": "latest"
+                            }
+                          },
+                          "extensionMonitoringAgentConfig": {
+                            "value": {
+                              "enabled": true,
+                              "tags": "[parameters('tags')]",
+                              "monitoringWorkspaceResourceId": "[parameters('logAnalyticsWorkspaceResourceId')]"
+                            }
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "7195052428088092384"
+                            },
+                            "name": "Virtual Machines",
+                            "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "managedIdentitiesType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "osDiskType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The disk name."
+                                  }
+                                },
+                                "diskSizeGB": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. Specifies the size of an empty data disk in gigabytes."
+                                  }
+                                },
+                                "createOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Attach",
+                                    "Empty",
+                                    "FromImage"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies how the virtual machine should be created."
+                                  }
+                                },
+                                "deleteOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Delete",
+                                    "Detach"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                                  }
+                                },
+                                "caching": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "None",
+                                    "ReadOnly",
+                                    "ReadWrite"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the caching requirements."
+                                  }
+                                },
+                                "managedDisk": {
+                                  "type": "object",
+                                  "properties": {
+                                    "storageAccountType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "PremiumV2_LRS",
+                                        "Premium_LRS",
+                                        "Premium_ZRS",
+                                        "StandardSSD_LRS",
+                                        "StandardSSD_ZRS",
+                                        "Standard_LRS",
+                                        "UltraSSD_LRS"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Specifies the storage account type for the managed disk."
+                                      }
+                                    },
+                                    "diskEncryptionSetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The managed disk parameters."
+                                  }
+                                }
+                              }
+                            },
+                            "dataDisksType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The disk name."
+                                    }
+                                  },
+                                  "lun": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies the logical unit number of the data disk."
+                                    }
+                                  },
+                                  "diskSizeGB": {
+                                    "type": "int",
+                                    "metadata": {
+                                      "description": "Required. Specifies the size of an empty data disk in gigabytes."
+                                    }
+                                  },
+                                  "createOption": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Attach",
+                                      "Empty",
+                                      "FromImage"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies how the virtual machine should be created."
+                                    }
+                                  },
+                                  "deleteOption": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Delete",
+                                      "Detach"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                                    }
+                                  },
+                                  "caching": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "None",
+                                      "ReadOnly",
+                                      "ReadWrite"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specifies the caching requirements."
+                                    }
+                                  },
+                                  "managedDisk": {
+                                    "type": "object",
+                                    "properties": {
+                                      "storageAccountType": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "PremiumV2_LRS",
+                                          "Premium_LRS",
+                                          "Premium_ZRS",
+                                          "StandardSSD_LRS",
+                                          "StandardSSD_ZRS",
+                                          "Standard_LRS",
+                                          "UltraSSD_LRS"
+                                        ],
+                                        "metadata": {
+                                          "description": "Required. Specifies the storage account type for the managed disk."
+                                        }
+                                      },
+                                      "diskEncryptionSetResourceId": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                                        }
+                                      }
+                                    },
+                                    "metadata": {
+                                      "description": "Required. The managed disk parameters."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
+                              }
+                            },
+                            "computerName": {
+                              "type": "string",
+                              "defaultValue": "[parameters('name')]",
+                              "metadata": {
+                                "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
+                              }
+                            },
+                            "vmSize": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the size for the VMs."
+                              }
+                            },
+                            "encryptionAtHost": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "securityType": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "secureBootEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "vTpmEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "imageReference": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "Required. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image."
+                              }
+                            },
+                            "plan": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
+                              }
+                            },
+                            "osDisk": {
+                              "$ref": "#/definitions/osDiskType",
+                              "metadata": {
+                                "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "dataDisks": {
+                              "$ref": "#/definitions/dataDisksType",
+                              "metadata": {
+                                "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "ultraSSDEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
+                              }
+                            },
+                            "adminUsername": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "Required. Administrator username."
+                              }
+                            },
+                            "adminPassword": {
+                              "type": "securestring",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. When specifying a Windows Virtual Machine, this value should be passed."
+                              }
+                            },
+                            "customData": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
+                              }
+                            },
+                            "certificatesToBeInstalled": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
+                              }
+                            },
+                            "priority": {
+                              "type": "string",
+                              "defaultValue": "Regular",
+                              "allowedValues": [
+                                "Regular",
+                                "Low",
+                                "Spot"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the priority for the virtual machine."
+                              }
+                            },
+                            "enableEvictionPolicy": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies the eviction policy for the low priority virtual machine. Will result in 'Deallocate' eviction policy."
+                              }
+                            },
+                            "maxPriceForLowPriorityVm": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
+                              }
+                            },
+                            "dedicatedHostId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
+                              }
+                            },
+                            "licenseType": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "RHEL_BYOS",
+                                "SLES_BYOS",
+                                "Windows_Client",
+                                "Windows_Server",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
+                              }
+                            },
+                            "publicKeys": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentitiesType",
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
+                              }
+                            },
+                            "bootDiagnostics": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
+                              }
+                            },
+                            "bootDiagnosticStorageAccountName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
+                              }
+                            },
+                            "bootDiagnosticStorageAccountUri": {
+                              "type": "string",
+                              "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
+                              "metadata": {
+                                "description": "Optional. Storage account boot diagnostic base URI."
+                              }
+                            },
+                            "proximityPlacementGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of a proximity placement group."
+                              }
+                            },
+                            "virtualMachineScaleSetResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
+                              }
+                            },
+                            "availabilitySetResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
+                              }
+                            },
+                            "galleryApplications": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
+                              }
+                            },
+                            "zone": {
+                              "type": "int",
+                              "allowedValues": [
+                                0,
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Required. If set to 1, 2 or 3, the availability zone for all VMs is hardcoded to that value. If zero, then availability zones is not used. Cannot be used in combination with availability set nor scale set."
+                              }
+                            },
+                            "nicConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. Configures NICs and PIPs."
+                              }
+                            },
+                            "backupVaultName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Recovery service vault name to add VMs to backup."
+                              }
+                            },
+                            "backupVaultResourceGroup": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().name]",
+                              "metadata": {
+                                "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
+                              }
+                            },
+                            "backupPolicyName": {
+                              "type": "string",
+                              "defaultValue": "DefaultPolicy",
+                              "metadata": {
+                                "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
+                              }
+                            },
+                            "autoShutdownConfig": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The configuration for auto-shutdown."
+                              }
+                            },
+                            "maintenanceConfigurationResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource Id of a maintenance configuration for this VM."
+                              }
+                            },
+                            "allowExtensionOperations": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
+                              }
+                            },
+                            "extensionDomainJoinPassword": {
+                              "type": "securestring",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
+                              }
+                            },
+                            "extensionDomainJoinConfig": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionAadJoinConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
+                              }
+                            },
+                            "extensionAntiMalwareConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionMonitoringAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionDependencyAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionNetworkWatcherAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionAzureDiskEncryptionConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
+                              }
+                            },
+                            "extensionDSCConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionCustomScriptConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false,
+                                "fileData": []
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Custom Script] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionNvidiaGpuDriverWindows": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionHostPoolRegistration": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+                              }
+                            },
+                            "extensionGuestConfigurationExtension": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+                              }
+                            },
+                            "guestConfiguration": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
+                              }
+                            },
+                            "extensionCustomScriptProtectedSetting": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. An object that contains the extension specific protected settings."
+                              }
+                            },
+                            "extensionGuestConfigurationExtensionProtectedSettings": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. An object that contains the extension specific protected settings."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "baseTime": {
+                              "type": "string",
+                              "defaultValue": "[utcNow('u')]",
+                              "metadata": {
+                                "description": "Generated. Do not provide a value! This date value is used to generate a registration token."
+                              }
+                            },
+                            "sasTokenValidityLength": {
+                              "type": "string",
+                              "defaultValue": "PT8H",
+                              "metadata": {
+                                "description": "Optional. SAS token validity length to use to download files from storage accounts. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours."
+                              }
+                            },
+                            "osType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Windows",
+                                "Linux"
+                              ],
+                              "metadata": {
+                                "description": "Required. The chosen OS type."
+                              }
+                            },
+                            "disablePasswordAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether password authentication should be disabled."
+                              }
+                            },
+                            "provisionVMAgent": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
+                              }
+                            },
+                            "enableAutomaticUpdates": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
+                              }
+                            },
+                            "patchMode": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "AutomaticByPlatform",
+                                "AutomaticByOS",
+                                "Manual",
+                                "ImageDefault",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+                              }
+                            },
+                            "bypassPlatformSafetyChecksOnUserSchedule": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enables customer to schedule patching without accidental upgrades."
+                              }
+                            },
+                            "rebootSetting": {
+                              "type": "string",
+                              "defaultValue": "IfRequired",
+                              "allowedValues": [
+                                "Always",
+                                "IfRequired",
+                                "Never",
+                                "Unknown"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
+                              }
+                            },
+                            "patchAssessmentMode": {
+                              "type": "string",
+                              "defaultValue": "ImageDefault",
+                              "allowedValues": [
+                                "AutomaticByPlatform",
+                                "ImageDefault"
+                              ],
+                              "metadata": {
+                                "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
+                              }
+                            },
+                            "timeZone": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
+                              }
+                            },
+                            "additionalUnattendContent": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
+                              }
+                            },
+                            "winRM": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell. - WinRMConfiguration object."
+                              }
+                            },
+                            "configurationProfile": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "publicKeysFormatted",
+                                "count": "[length(parameters('publicKeys'))]",
+                                "input": {
+                                  "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
+                                  "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
+                                }
+                              }
+                            ],
+                            "linuxConfiguration": {
+                              "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
+                              "ssh": {
+                                "publicKeys": "[variables('publicKeysFormatted')]"
+                              },
+                              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
+                            },
+                            "windowsConfiguration": {
+                              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                              "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
+                              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+                              "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
+                              "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), parameters('additionalUnattendContent'))]",
+                              "winRM": "[if(not(empty(parameters('winRM'))), createObject('listeners', parameters('winRM')), null())]"
+                            },
+                            "accountSasProperties": {
+                              "signedServices": "b",
+                              "signedPermission": "r",
+                              "signedExpiry": "[dateTimeAdd(parameters('baseTime'), parameters('sasTokenValidityLength'))]",
+                              "signedResourceTypes": "o",
+                              "signedProtocol": "https"
+                            },
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
+                              "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
+                              "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
+                              "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
+                              "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
+                              "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
+                              "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
+                              "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
+                              "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
+                              "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
+                              "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
+                              "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "vm": {
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2023-09-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "zones": "[if(not(equals(parameters('zone'), 0)), array(string(parameters('zone'))), null())]",
+                              "plan": "[if(not(empty(parameters('plan'))), parameters('plan'), null())]",
+                              "properties": {
+                                "hardwareProfile": {
+                                  "vmSize": "[parameters('vmSize')]"
+                                },
+                                "securityProfile": {
+                                  "encryptionAtHost": "[if(parameters('encryptionAtHost'), parameters('encryptionAtHost'), null())]",
+                                  "securityType": "[parameters('securityType')]",
+                                  "uefiSettings": "[if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null())]"
+                                },
+                                "storageProfile": {
+                                  "copy": [
+                                    {
+                                      "name": "dataDisks",
+                                      "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
+                                      "input": {
+                                        "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
+                                        "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))]",
+                                        "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].diskSizeGB]",
+                                        "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createoption'), 'Empty')]",
+                                        "deleteOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete')]",
+                                        "caching": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly')]",
+                                        "managedDisk": {
+                                          "storageAccountType": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.storageAccountType]",
+                                          "diskEncryptionSet": {
+                                            "id": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId')]"
+                                          }
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "imageReference": "[parameters('imageReference')]",
+                                  "osDisk": {
+                                    "name": "[coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name')))]",
+                                    "createOption": "[coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage')]",
+                                    "deleteOption": "[coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete')]",
+                                    "diskSizeGB": "[parameters('osDisk').diskSizeGB]",
+                                    "caching": "[coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly')]",
+                                    "managedDisk": {
+                                      "storageAccountType": "[parameters('osDisk').managedDisk.storageAccountType]",
+                                      "diskEncryptionSet": {
+                                        "id": "[tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')]"
+                                      }
+                                    }
+                                  }
+                                },
+                                "additionalCapabilities": {
+                                  "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]"
+                                },
+                                "osProfile": {
+                                  "computerName": "[parameters('computerName')]",
+                                  "adminUsername": "[parameters('adminUsername')]",
+                                  "adminPassword": "[parameters('adminPassword')]",
+                                  "customData": "[if(not(empty(parameters('customData'))), base64(parameters('customData')), null())]",
+                                  "windowsConfiguration": "[if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null())]",
+                                  "linuxConfiguration": "[if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null())]",
+                                  "secrets": "[parameters('certificatesToBeInstalled')]",
+                                  "allowExtensionOperations": "[parameters('allowExtensionOperations')]"
+                                },
+                                "networkProfile": {
+                                  "copy": [
+                                    {
+                                      "name": "networkInterfaces",
+                                      "count": "[length(parameters('nicConfigurations'))]",
+                                      "input": {
+                                        "properties": {
+                                          "deleteOption": "[if(contains(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].deleteOption, 'Delete')]",
+                                          "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
+                                        },
+                                        "id": "[resourceId('Microsoft.Network/networkInterfaces', if(contains(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].name, format('{0}{1}', parameters('name'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].nicSuffix)))]"
+                                      }
+                                    }
+                                  ]
+                                },
+                                "diagnosticsProfile": {
+                                  "bootDiagnostics": {
+                                    "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
+                                    "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
+                                  }
+                                },
+                                "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
+                                "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
+                                "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
+                                "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
+                                "priority": "[parameters('priority')]",
+                                "evictionPolicy": "[if(parameters('enableEvictionPolicy'), 'Deallocate', null())]",
+                                "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
+                                "host": "[if(not(empty(parameters('dedicatedHostId'))), createObject('id', parameters('dedicatedHostId')), null())]",
+                                "licenseType": "[if(not(empty(parameters('licenseType'))), parameters('licenseType'), null())]"
+                              },
+                              "dependsOn": [
+                                "vm_nic"
+                              ]
+                            },
+                            "vm_configurationAssignment": {
+                              "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
+                              "type": "Microsoft.Maintenance/configurationAssignments",
+                              "apiVersion": "2023-04-01",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "[format('{0}assignment', parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
+                                "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_configurationProfileAssignment": {
+                              "condition": "[not(empty(parameters('configurationProfile')))]",
+                              "type": "Microsoft.Automanage/configurationProfileAssignments",
+                              "apiVersion": "2022-05-04",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "default",
+                              "properties": {
+                                "configurationProfile": "[parameters('configurationProfile')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_autoShutdownConfiguration": {
+                              "condition": "[not(empty(parameters('autoShutdownConfig')))]",
+                              "type": "Microsoft.DevTestLab/schedules",
+                              "apiVersion": "2018-09-15",
+                              "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "status": "[if(contains(parameters('autoShutdownConfig'), 'status'), parameters('autoShutdownConfig').status, 'Disabled')]",
+                                "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                                "taskType": "ComputeVmShutdownTask",
+                                "dailyRecurrence": {
+                                  "time": "[if(contains(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), parameters('autoShutdownConfig').dailyRecurrenceTime, '19:00')]"
+                                },
+                                "timeZoneId": "[if(contains(parameters('autoShutdownConfig'), 'timeZone'), parameters('autoShutdownConfig').timeZone, 'UTC')]",
+                                "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), createObject('status', if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), parameters('autoShutdownConfig').notificationStatus, 'Disabled'), 'emailRecipient', if(contains(parameters('autoShutdownConfig'), 'notificationEmail'), parameters('autoShutdownConfig').notificationEmail, ''), 'notificationLocale', if(contains(parameters('autoShutdownConfig'), 'notificationLocale'), parameters('autoShutdownConfig').notificationLocale, 'en'), 'webhookUrl', if(contains(parameters('autoShutdownConfig'), 'notificationWebhookUrl'), parameters('autoShutdownConfig').notificationWebhookUrl, ''), 'timeInMinutes', if(contains(parameters('autoShutdownConfig'), 'notificationTimeInMinutes'), parameters('autoShutdownConfig').notificationTimeInMinutes, 30)), null())]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_logAnalyticsWorkspace": {
+                              "condition": "[not(empty(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2021-06-01",
+                              "subscriptionId": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2]]",
+                              "resourceGroup": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]]",
+                              "name": "[last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))]"
+                            },
+                            "AzureWindowsBaseline": {
+                              "condition": "[not(empty(parameters('guestConfiguration')))]",
+                              "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
+                              "apiVersion": "2020-06-25",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "AzureWindowsBaseline",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "guestConfiguration": "[parameters('guestConfiguration')]"
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureGuestConfigurationExtension"
+                              ]
+                            },
+                            "vm_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_roleAssignments": {
+                              "copy": {
+                                "name": "vm_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_nic": {
+                              "copy": {
+                                "name": "vm_nic",
+                                "count": "[length(parameters('nicConfigurations'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "networkInterfaceName": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'name'), createObject('value', parameters('nicConfigurations')[copyIndex()].name), createObject('value', format('{0}{1}', parameters('name'), parameters('nicConfigurations')[copyIndex()].nicSuffix)))]",
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableIPForwarding": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), createObject('value', parameters('nicConfigurations')[copyIndex()].enableIPForwarding), createObject('value', false()))]",
+                                  "enableAcceleratedNetworking": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), createObject('value', parameters('nicConfigurations')[copyIndex()].enableAcceleratedNetworking), createObject('value', true()))]",
+                                  "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(parameters('nicConfigurations')[copyIndex()].dnsServers)), createObject('value', parameters('nicConfigurations')[copyIndex()].dnsServers), createObject('value', createArray())), createObject('value', createArray()))]",
+                                  "networkSecurityGroupResourceId": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), createObject('value', parameters('nicConfigurations')[copyIndex()].networkSecurityGroupResourceId), createObject('value', ''))]",
+                                  "ipConfigurations": {
+                                    "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "6185170122493883924"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "diagnosticSettingType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of diagnostic setting."
+                                            }
+                                          },
+                                          "logCategoriesAndGroups": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "category": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                  }
+                                                },
+                                                "categoryGroup": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                  }
+                                                },
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                            }
+                                          },
+                                          "metricCategories": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "category": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                  }
+                                                },
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                            }
+                                          },
+                                          "logAnalyticsDestinationType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "AzureDiagnostics",
+                                              "Dedicated"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                            }
+                                          },
+                                          "workspaceResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                            }
+                                          },
+                                          "storageAccountResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                            }
+                                          },
+                                          "eventHubAuthorizationRuleResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                            }
+                                          },
+                                          "eventHubName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                            }
+                                          },
+                                          "marketplacePartnerResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "networkInterfaceName": {
+                                      "type": "string"
+                                    },
+                                    "virtualMachineName": {
+                                      "type": "string"
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "enableIPForwarding": {
+                                      "type": "bool",
+                                      "defaultValue": false
+                                    },
+                                    "enableAcceleratedNetworking": {
+                                      "type": "bool",
+                                      "defaultValue": false
+                                    },
+                                    "dnsServers": {
+                                      "type": "array",
+                                      "defaultValue": []
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
+                                      }
+                                    },
+                                    "networkSecurityGroupResourceId": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "$ref": "#/definitions/diagnosticSettingType",
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the Network Interface."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "networkInterface_publicIPAddresses": {
+                                      "copy": {
+                                        "name": "networkInterface_publicIPAddresses",
+                                        "count": "[length(parameters('ipConfigurations'))]"
+                                      },
+                                      "condition": "[contains(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'name'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.name), createObject('value', format('{0}{1}', parameters('virtualMachineName'), parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIpNameSuffix)))]",
+                                          "diagnosticSettings": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "lock": {
+                                            "value": "[parameters('lock')]"
+                                          },
+                                          "idleTimeoutInMinutes": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'idleTimeoutInMinutes')]"
+                                          },
+                                          "ddosSettings": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'ddosSettings')]"
+                                          },
+                                          "dnsSettings": {
+                                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'dnsSettings')]"
+                                          },
+                                          "publicIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressVersion'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPAddressVersion), createObject('value', 'IPv4'))]",
+                                          "publicIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAllocationMethod'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPAllocationMethod), createObject('value', 'Static'))]",
+                                          "publicIpPrefixResourceId": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPPrefixResourceId'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPPrefixResourceId), createObject('value', ''))]",
+                                          "roleAssignments": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'roleAssignments'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.roleAssignments), createObject('value', createArray()))]",
+                                          "skuName": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuName'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.skuName), createObject('value', 'Standard'))]",
+                                          "skuTier": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuTier'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.skuTier), createObject('value', 'Regional'))]",
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "zones": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'zones'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.zones), createObject('value', createArray(1, 2, 3)))]",
+                                          "enableTelemetry": {
+                                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.27.1.19265",
+                                              "templateHash": "10356333973104369631"
+                                            },
+                                            "name": "Public IP Addresses",
+                                            "description": "This module deploys a Public IP Address.",
+                                            "owner": "Azure/module-maintainers"
+                                          },
+                                          "definitions": {
+                                            "roleAssignmentType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "roleDefinitionIdOrName": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                    }
+                                                  },
+                                                  "principalId": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                    }
+                                                  },
+                                                  "principalType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Device",
+                                                      "ForeignGroup",
+                                                      "Group",
+                                                      "ServicePrincipal",
+                                                      "User"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The principal type of the assigned principal ID."
+                                                    }
+                                                  },
+                                                  "description": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The description of the role assignment."
+                                                    }
+                                                  },
+                                                  "condition": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                    }
+                                                  },
+                                                  "conditionVersion": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "2.0"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Version of the condition."
+                                                    }
+                                                  },
+                                                  "delegatedManagedIdentityResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "dnsSettingsType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "domainNameLabel": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                                  }
+                                                },
+                                                "domainNameLabelScope": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "",
+                                                    "NoReuse",
+                                                    "ResourceGroupReuse",
+                                                    "SubscriptionReuse",
+                                                    "TenantReuse"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                                  }
+                                                },
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                                  }
+                                                },
+                                                "reverseFqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "ddosSettingsType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "ddosProtectionPlan": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "id": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                                  }
+                                                },
+                                                "protectionMode": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Enabled"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. The DDoS protection policy customizations."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "diagnosticSettingType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of diagnostic setting."
+                                                    }
+                                                  },
+                                                  "logCategoriesAndGroups": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                          }
+                                                        },
+                                                        "categoryGroup": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                    }
+                                                  },
+                                                  "metricCategories": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                    }
+                                                  },
+                                                  "logAnalyticsDestinationType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "AzureDiagnostics",
+                                                      "Dedicated"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                    }
+                                                  },
+                                                  "workspaceResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "storageAccountResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "eventHubAuthorizationRuleResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                    }
+                                                  },
+                                                  "eventHubName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "marketplacePartnerResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Public IP Address."
+                                              }
+                                            },
+                                            "publicIpPrefixResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                              }
+                                            },
+                                            "publicIPAllocationMethod": {
+                                              "type": "string",
+                                              "defaultValue": "Static",
+                                              "allowedValues": [
+                                                "Dynamic",
+                                                "Static"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The public IP address allocation method."
+                                              }
+                                            },
+                                            "zones": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "int"
+                                              },
+                                              "defaultValue": [
+                                                1,
+                                                2,
+                                                3
+                                              ],
+                                              "allowedValues": [
+                                                1,
+                                                2,
+                                                3
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                                              }
+                                            },
+                                            "publicIPAddressVersion": {
+                                              "type": "string",
+                                              "defaultValue": "IPv4",
+                                              "allowedValues": [
+                                                "IPv4",
+                                                "IPv6"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. IP address version."
+                                              }
+                                            },
+                                            "dnsSettings": {
+                                              "$ref": "#/definitions/dnsSettingsType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The DNS settings of the public IP address."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "skuName": {
+                                              "type": "string",
+                                              "defaultValue": "Standard",
+                                              "allowedValues": [
+                                                "Basic",
+                                                "Standard"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Name of a public IP address SKU."
+                                              }
+                                            },
+                                            "skuTier": {
+                                              "type": "string",
+                                              "defaultValue": "Regional",
+                                              "allowedValues": [
+                                                "Global",
+                                                "Regional"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Tier of a public IP address SKU."
+                                              }
+                                            },
+                                            "ddosSettings": {
+                                              "$ref": "#/definitions/ddosSettingsType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "$ref": "#/definitions/roleAssignmentType",
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "idleTimeoutInMinutes": {
+                                              "type": "int",
+                                              "defaultValue": 4,
+                                              "metadata": {
+                                                "description": "Optional. The idle timeout of the public IP address."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags of the resource."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "$ref": "#/definitions/diagnosticSettingType",
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2023-07-01",
+                                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "publicIpAddress": {
+                                              "type": "Microsoft.Network/publicIPAddresses",
+                                              "apiVersion": "2023-09-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "sku": {
+                                                "name": "[parameters('skuName')]",
+                                                "tier": "[parameters('skuTier')]"
+                                              },
+                                              "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                                              "properties": {
+                                                "ddosSettings": "[parameters('ddosSettings')]",
+                                                "dnsSettings": "[parameters('dnsSettings')]",
+                                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                                "ipTags": null
+                                              }
+                                            },
+                                            "publicIpAddress_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            },
+                                            "publicIpAddress_roleAssignments": {
+                                              "copy": {
+                                                "name": "publicIpAddress_roleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                              "properties": {
+                                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            },
+                                            "publicIpAddress_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "publicIpAddress_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the public IP address was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the public IP address."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the public IP address."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                                            },
+                                            "ipAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The public IP address of the public IP address resource."
+                                              },
+                                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "networkInterface": {
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-NetworkInterface', deployment().name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[parameters('networkInterfaceName')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "copy": [
+                                              {
+                                                "name": "value",
+                                                "count": "[length(parameters('ipConfigurations'))]",
+                                                "input": "[createObject('name', if(not(empty(parameters('ipConfigurations')[copyIndex('value')].name)), parameters('ipConfigurations')[copyIndex('value')].name, null()), 'primary', equals(copyIndex('value'), 0), 'privateIPAllocationMethod', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod, null()), null()), 'privateIPAddress', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('value')].privateIPAddress, null()), null()), 'publicIPAddressResourceId', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), resourceId('Microsoft.Network/publicIPAddresses', if(contains(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'name'), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.name, format('{0}{1}', parameters('virtualMachineName'), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.publicIpNameSuffix))), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('value')].loadBalancerBackendAddressPools, null()), 'applicationSecurityGroups', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('value')].applicationSecurityGroups, null()), 'applicationGatewayBackendAddressPools', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('value')].applicationGatewayBackendAddressPools, null()), 'gatewayLoadBalancer', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('value')].gatewayLoadBalancer, null()), 'loadBalancerInboundNatRules', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('value')].loadBalancerInboundNatRules, null()), 'privateIPAddressVersion', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('value')].privateIPAddressVersion, null()), 'virtualNetworkTaps', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('value')].virtualNetworkTaps, null()))]"
+                                              }
+                                            ]
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "tags": {
+                                            "value": "[parameters('tags')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[parameters('diagnosticSettings')]"
+                                          },
+                                          "dnsServers": "[if(not(empty(parameters('dnsServers'))), createObject('value', parameters('dnsServers')), createObject('value', createArray()))]",
+                                          "enableAcceleratedNetworking": {
+                                            "value": "[parameters('enableAcceleratedNetworking')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[parameters('enableTelemetry')]"
+                                          },
+                                          "enableIPForwarding": {
+                                            "value": "[parameters('enableIPForwarding')]"
+                                          },
+                                          "lock": {
+                                            "value": "[parameters('lock')]"
+                                          },
+                                          "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
+                                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.25.53.49325",
+                                              "templateHash": "1612343535299711142"
+                                            },
+                                            "name": "Network Interface",
+                                            "description": "This module deploys a Network Interface.",
+                                            "owner": "Azure/module-maintainers"
+                                          },
+                                          "definitions": {
+                                            "diagnosticSettingType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of diagnostic setting."
+                                                    }
+                                                  },
+                                                  "logCategoriesAndGroups": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                          }
+                                                        },
+                                                        "categoryGroup": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                    }
+                                                  },
+                                                  "metricCategories": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "category": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                          }
+                                                        },
+                                                        "enabled": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                    }
+                                                  },
+                                                  "logAnalyticsDestinationType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "AzureDiagnostics",
+                                                      "Dedicated"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                    }
+                                                  },
+                                                  "workspaceResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "storageAccountResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "eventHubAuthorizationRuleResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                    }
+                                                  },
+                                                  "eventHubName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                    }
+                                                  },
+                                                  "marketplacePartnerResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "roleDefinitionIdOrName": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                    }
+                                                  },
+                                                  "principalId": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                    }
+                                                  },
+                                                  "principalType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Device",
+                                                      "ForeignGroup",
+                                                      "Group",
+                                                      "ServicePrincipal",
+                                                      "User"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The principal type of the assigned principal ID."
+                                                    }
+                                                  },
+                                                  "description": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The description of the role assignment."
+                                                    }
+                                                  },
+                                                  "condition": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                    }
+                                                  },
+                                                  "conditionVersion": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "2.0"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Version of the condition."
+                                                    }
+                                                  },
+                                                  "delegatedManagedIdentityResourceId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the network interface."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource tags."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "enableIPForwarding": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                                              }
+                                            },
+                                            "enableAcceleratedNetworking": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. If the network interface is accelerated networking enabled."
+                                              }
+                                            },
+                                            "dnsServers": {
+                                              "type": "array",
+                                              "defaultValue": [],
+                                              "metadata": {
+                                                "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                                              }
+                                            },
+                                            "networkSecurityGroupResourceId": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                              }
+                                            },
+                                            "auxiliaryMode": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "Floating",
+                                                "MaxConnections",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                              }
+                                            },
+                                            "auxiliarySku": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "A1",
+                                                "A2",
+                                                "A4",
+                                                "A8",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                              }
+                                            },
+                                            "disableTcpStateTracking": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "description": "Required. A list of IPConfigurations of the network interface."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "$ref": "#/definitions/roleAssignmentType",
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "$ref": "#/definitions/diagnosticSettingType",
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2023-07-01",
+                                              "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.2.4', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "networkInterface": {
+                                              "type": "Microsoft.Network/networkInterfaces",
+                                              "apiVersion": "2023-04-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "ipConfigurations",
+                                                    "count": "[length(parameters('ipConfigurations'))]",
+                                                    "input": {
+                                                      "name": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].name, format('ipconfig0{0}', add(copyIndex('ipConfigurations'), 1)))]",
+                                                      "properties": {
+                                                        "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
+                                                        "privateIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod, null()), null())]",
+                                                        "privateIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress, null()), null())]",
+                                                        "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId, null())), createObject('id', parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId), null()), null())]",
+                                                        "subnet": {
+                                                          "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
+                                                        },
+                                                        "loadBalancerBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerBackendAddressPools, null())]",
+                                                        "applicationSecurityGroups": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationSecurityGroups, null())]",
+                                                        "applicationGatewayBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationGatewayBackendAddressPools, null())]",
+                                                        "gatewayLoadBalancer": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].gatewayLoadBalancer, null())]",
+                                                        "loadBalancerInboundNatRules": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerInboundNatRules, null())]",
+                                                        "privateIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddressVersion, null())]",
+                                                        "virtualNetworkTaps": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].virtualNetworkTaps, null())]"
+                                                      }
+                                                    }
+                                                  }
+                                                ],
+                                                "auxiliaryMode": "[parameters('auxiliaryMode')]",
+                                                "auxiliarySku": "[parameters('auxiliarySku')]",
+                                                "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
+                                                "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
+                                                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
+                                                "enableIPForwarding": "[parameters('enableIPForwarding')]",
+                                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
+                                              }
+                                            },
+                                            "networkInterface_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            },
+                                            "networkInterface_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "networkInterface_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            },
+                                            "networkInterface_roleAssignments": {
+                                              "copy": {
+                                                "name": "networkInterface_roleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                              "properties": {
+                                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed resource."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed resource."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed resource."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('networkInterface', '2023-04-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "networkInterface_publicIPAddresses"
+                                      ]
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "vm_aadJoinExtension": {
+                              "condition": "[parameters('extensionAadJoinConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "AADLogin"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.ActiveDirectory"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAadJoinConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '2.0'), createObject('value', '1.0')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAadJoinConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAadJoinConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": "[if(contains(parameters('extensionAadJoinConfig'), 'settings'), createObject('value', parameters('extensionAadJoinConfig').settings), createObject('value', createObject()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_domainJoinExtension": {
+                              "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "DomainJoin"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Compute"
+                                  },
+                                  "type": {
+                                    "value": "JsonADDomainExtension"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDomainJoinConfig').typeHandlerVersion), createObject('value', '1.3'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDomainJoinConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDomainJoinConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": "[parameters('extensionDomainJoinConfig').settings]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": {
+                                      "Password": "[parameters('extensionDomainJoinPassword')]"
+                                    }
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_aadJoinExtension"
+                              ]
+                            },
+                            "vm_microsoftAntiMalwareExtension": {
+                              "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "MicrosoftAntiMalware"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Security"
+                                  },
+                                  "type": {
+                                    "value": "IaaSAntimalware"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAntiMalwareConfig').typeHandlerVersion), createObject('value', '1.3'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAntiMalwareConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAntiMalwareConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": "[parameters('extensionAntiMalwareConfig').settings]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_domainJoinExtension"
+                              ]
+                            },
+                            "vm_azureMonitorAgentExtension": {
+                              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "AzureMonitorAgent"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Monitor"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": {
+                                      "workspaceId": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), reference('vm_logAnalyticsWorkspace').customerId, '')]",
+                                      "GCS_AUTO_CONFIG": "[if(equals(parameters('osType'), 'Linux'), true(), null())]"
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": {
+                                      "workspaceKey": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2], split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))), '2021-06-01').primarySharedKey, '')]"
+                                    }
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_logAnalyticsWorkspace",
+                                "vm_microsoftAntiMalwareExtension"
+                              ]
+                            },
+                            "vm_dependencyAgentExtension": {
+                              "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "DependencyAgent"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Monitoring.DependencyAgent"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDependencyAgentConfig').typeHandlerVersion), createObject('value', '9.10'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDependencyAgentConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDependencyAgentConfig').enableAutomaticUpgrade), createObject('value', true()))]",
+                                  "settings": {
+                                    "value": {
+                                      "enableAMA": "[if(contains(parameters('extensionDependencyAgentConfig'), 'enableAMA'), parameters('extensionDependencyAgentConfig').enableAMA, true())]"
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureMonitorAgentExtension"
+                              ]
+                            },
+                            "vm_networkWatcherAgentExtension": {
+                              "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "NetworkWatcherAgent"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.NetworkWatcher"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').typeHandlerVersion), createObject('value', '1.4'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_dependencyAgentExtension"
+                              ]
+                            },
+                            "vm_desiredStateConfigurationExtension": {
+                              "condition": "[parameters('extensionDSCConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "DesiredStateConfiguration"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Powershell"
+                                  },
+                                  "type": {
+                                    "value": "DSC"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionDSCConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDSCConfig').typeHandlerVersion), createObject('value', '2.77'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDSCConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDSCConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": "[if(contains(parameters('extensionDSCConfig'), 'settings'), createObject('value', parameters('extensionDSCConfig').settings), createObject('value', createObject()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": "[if(contains(parameters('extensionDSCConfig'), 'protectedSettings'), createObject('value', parameters('extensionDSCConfig').protectedSettings), createObject('value', createObject()))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_networkWatcherAgentExtension"
+                              ]
+                            },
+                            "vm_customScriptExtension": {
+                              "condition": "[parameters('extensionCustomScriptConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "CustomScriptExtension"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionCustomScriptConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '1.10'), createObject('value', '2.1')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionCustomScriptConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionCustomScriptConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": {
+                                      "copy": [
+                                        {
+                                          "name": "fileUris",
+                                          "count": "[length(parameters('extensionCustomScriptConfig').fileData)]",
+                                          "input": "[if(contains(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')], 'storageAccountId'), format('{0}?{1}', parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri, listAccountSas(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].storageAccountId, '2019-04-01', variables('accountSasProperties')).accountSasToken), parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri)]"
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[parameters('extensionCustomScriptProtectedSetting')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_desiredStateConfigurationExtension"
+                              ]
+                            },
+                            "vm_azureDiskEncryptionExtension": {
+                              "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "AzureDiskEncryption"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Security"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '2.2'), createObject('value', '1.1')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "forceUpdateTag": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').forceUpdateTag), createObject('value', '1.0'))]",
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_customScriptExtension"
+                              ]
+                            },
+                            "vm_nvidiaGpuDriverWindowsExtension": {
+                              "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "NvidiaGpuDriverWindows"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.HpcCompute"
+                                  },
+                                  "type": {
+                                    "value": "NvidiaGpuDriverWindows"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').typeHandlerVersion), createObject('value', '1.4'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureDiskEncryptionExtension"
+                              ]
+                            },
+                            "vm_hostPoolRegistrationExtension": {
+                              "condition": "[parameters('extensionHostPoolRegistration').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "HostPoolRegistration"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.PowerShell"
+                                  },
+                                  "type": {
+                                    "value": "DSC"
+                                  },
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), createObject('value', parameters('extensionHostPoolRegistration').typeHandlerVersion), createObject('value', '2.77'))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionHostPoolRegistration').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionHostPoolRegistration').enableAutomaticUpgrade), createObject('value', false()))]",
+                                  "settings": {
+                                    "value": {
+                                      "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
+                                      "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
+                                      "properties": {
+                                        "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
+                                        "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]",
+                                        "aadJoin": true
+                                      },
+                                      "supressFailures": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
+                                    }
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_nvidiaGpuDriverWindowsExtension"
+                              ]
+                            },
+                            "vm_azureGuestConfigurationExtension": {
+                              "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.GuestConfiguration"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
+                                  "typeHandlerVersion": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), createObject('value', parameters('extensionGuestConfigurationExtension').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '1.0'), createObject('value', '1.0')))]",
+                                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionGuestConfigurationExtension').autoUpgradeMinorVersion), createObject('value', true()))]",
+                                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionGuestConfigurationExtension').enableAutomaticUpgrade), createObject('value', true()))]",
+                                  "forceUpdateTag": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), createObject('value', parameters('extensionGuestConfigurationExtension').forceUpdateTag), createObject('value', '1.0'))]",
+                                  "settings": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject('value', parameters('extensionGuestConfigurationExtension').settings), createObject('value', createObject()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "15287507275706455668"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2022-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                                        "suppressFailures": "[parameters('supressFailures')]"
+                                      },
+                                      "dependsOn": [
+                                        "virtualMachine"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_hostPoolRegistrationExtension"
+                              ]
+                            },
+                            "vm_backup": {
+                              "condition": "[not(empty(parameters('backupVaultName')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
+                              "resourceGroup": "[parameters('backupVaultResourceGroup')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "policyId": {
+                                    "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
+                                  },
+                                  "protectedItemType": {
+                                    "value": "Microsoft.Compute/virtualMachines"
+                                  },
+                                  "protectionContainerName": {
+                                    "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                                  },
+                                  "recoveryVaultName": {
+                                    "value": "[parameters('backupVaultName')]"
+                                  },
+                                  "sourceResourceId": {
+                                    "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "4311417160342913977"
+                                    },
+                                    "name": "Recovery Service Vaults Protection Container Protected Item",
+                                    "description": "This module deploys a Recovery Services Vault Protection Container Protected Item.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the resource."
+                                      }
+                                    },
+                                    "protectionContainerName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "recoveryVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "protectedItemType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureFileShareProtectedItem",
+                                        "AzureVmWorkloadSAPAseDatabase",
+                                        "AzureVmWorkloadSAPHanaDatabase",
+                                        "AzureVmWorkloadSQLDatabase",
+                                        "DPMProtectedItem",
+                                        "GenericProtectedItem",
+                                        "MabFileFolderProtectedItem",
+                                        "Microsoft.ClassicCompute/virtualMachines",
+                                        "Microsoft.Compute/virtualMachines",
+                                        "Microsoft.Sql/servers/databases"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The backup item type."
+                                      }
+                                    },
+                                    "policyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. ID of the backup policy with which this item is backed up."
+                                      }
+                                    },
+                                    "sourceResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the resource to back up."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
+                                      "apiVersion": "2023-01-01",
+                                      "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "protectedItemType": "[parameters('protectedItemType')]",
+                                        "policyId": "[parameters('policyId')]",
+                                        "sourceResourceId": "[parameters('sourceResourceId')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the protected item was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the protected item."
+                                      },
+                                      "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The Name of the protected item."
+                                      },
+                                      "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureGuestConfigurationExtension"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the VM."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the VM."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the VM was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(reference('vm', '2023-09-01', 'full'), 'identity'), 'principalId'), '')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('vm', '2023-09-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', format('dep-mc-{0}', parameters('vmName')))]",
+                        "[resourceId('Microsoft.Network/virtualNetworks/subnets', split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[0], split(format('{0}/{1}', parameters('vmVnetName'), parameters('vmSubnetName')), '/')[1])]"
+                      ]
+                    }
+                  ]
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "An optional Windows virtual machine deployment to act as a jump box."
+              }
+            }
+          ],
+          "outputs": {
+            "spokeResourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the spoke resource group."
+              },
+              "value": "[take(format('rg-{0}', deployment().name), 64)]"
+            },
+            "spokeVNetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the spoke virtual network."
+              },
+              "value": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Network/virtualNetworks', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64)), '2022-09-01').outputs.name.value)]"
+            },
+            "spokeVNetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the spoke virtual network."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64)), '2022-09-01').outputs.name.value]"
+            },
+            "spokeInfraSubnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the spoke infrastructure subnet."
+              },
+              "value": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Network/virtualNetworks/subnets', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64)), '2022-09-01').outputs.name.value, parameters('spokeInfraSubnetName'))]"
+            },
+            "spokeInfraSubnetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the spoke infrastructure subnet."
+              },
+              "value": "[parameters('spokeInfraSubnetName')]"
+            },
+            "spokePrivateEndpointsSubnetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the spoke private endpoints subnet."
+              },
+              "value": "[parameters('spokePrivateEndpointsSubnetName')]"
+            },
+            "spokeApplicationGatewaySubnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the spoke Application Gateway subnet. This is '' if the subnet was not created."
+              },
+              "value": "[if(not(empty(parameters('spokeApplicationGatewaySubnetAddressPrefix'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Network/virtualNetworks/subnets', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('vnetSpoke-{0}', deployment().name), 64)), '2022-09-01').outputs.name.value, parameters('spokeApplicationGatewaySubnetName')), '')]"
+            },
+            "spokeApplicationGatewaySubnetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the spoke Application Gateway subnet.  This is '' if the subnet was not created."
+              },
+              "value": "[if(not(empty(parameters('spokeApplicationGatewaySubnetAddressPrefix'))), parameters('spokeApplicationGatewaySubnetName'), '')]"
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Azure Log Analytics Workspace."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('logAnalyticsWs-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceId.value]"
+            },
+            "vmJumpBoxName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the jump box virtual machine."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('spokeNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.vmJumpBox]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('supportingServices-{0}-deployment', deployment().name), 64)]",
+      "resourceGroup": "[variables('rgSpokeName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "spokePrivateEndpointSubnetName": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokePrivateEndpointsSubnetName.value]"
+          },
+          "environment": {
+            "value": "[parameters('environment')]"
+          },
+          "workloadName": {
+            "value": "[parameters('workloadName')]"
+          },
+          "spokeVNetId": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeVNetId.value]"
+          },
+          "hubVNetId": {
+            "value": "[parameters('hubVirtualNetworkResourceId')]"
+          },
+          "logAnalyticsWorkspaceId": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.logAnalyticsWorkspaceId.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "4540495316729936890"
+            }
+          },
+          "parameters": {
+            "workloadName": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 10,
+              "metadata": {
+                "description": "The name of the workload that is being deployed. Up to 10 characters long."
+              }
+            },
+            "environment": {
+              "type": "string",
+              "maxLength": 8,
+              "metadata": {
+                "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\"). Up to 8 characters long."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "The location where the resources will be created. This needs to be the same region as the spoke."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The tags to be assigned to the created resources."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Whether to enable deployment telemetry."
+              }
+            },
+            "hubVNetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing hub virtual network."
+              }
+            },
+            "spokeVNetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing spoke virtual network to which the private endpoint will be connected."
+              }
+            },
+            "spokePrivateEndpointSubnetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the existing subnet in the spoke virtual to which the private endpoint will be connected."
+              }
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of the diagnostic log analytics workspace. If left empty, no diagnostics settings will be defined."
+              }
+            },
+            "deployZoneRedundantResources": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "uniqueId": {
+                    "value": "[uniqueString(resourceGroup().id)]"
+                  },
+                  "environment": {
+                    "value": "[parameters('environment')]"
+                  },
+                  "workloadName": {
+                    "value": "[parameters('workloadName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "4794676376542080363"
+                    }
+                  },
+                  "parameters": {
+                    "workloadName": {
+                      "type": "string",
+                      "minLength": 2,
+                      "maxLength": 10,
+                      "metadata": {
+                        "description": "The name of the workloard that is being deployed. Up to 10 characters long."
+                      }
+                    },
+                    "environment": {
+                      "type": "string",
+                      "maxLength": 8,
+                      "metadata": {
+                        "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\") Up to 8 characters long."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location for all Resources."
+                      }
+                    },
+                    "uniqueId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness"
+                      }
+                    }
+                  },
+                  "variables": {
+                    "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+                    "naming": "[json(variables('$fxv#0'))]",
+                    "uniqueIdShort": "[substring(parameters('uniqueId'), 0, 5)]",
+                    "resourceTypeToken": "RES_TYPE",
+                    "namingBase": "[format('{0}-{1}-{2}-{3}', variables('resourceTypeToken'), parameters('workloadName'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseUnique": "[format('{0}-{1}-{2}-{3}-{4}', variables('resourceTypeToken'), parameters('workloadName'), variables('uniqueIdShort'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseNoWorkloadName": "[format('{0}-{1}-{2}', variables('resourceTypeToken'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "resourceTypeAbbreviations": "[variables('naming').resourceTypeAbbreviations]",
+                    "keyVaultName": "[take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault), 24)]",
+                    "resourceNames": {
+                      "vnetSpoke": "[format('{0}-spoke', replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "vnetHub": "[format('{0}-hub', replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "applicationGateway": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway)]",
+                      "applicationGatewayPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayUserAssignedIdentity": "[format('{0}-{1}-KeyVaultSecretUser', variables('naming').resourceTypeAbbreviations.managedIdentity, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "pepNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.privateEndpoint))]",
+                      "applicationInsights": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationInsights)]",
+                      "azureFirewall": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall)]",
+                      "azureFirewallPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall))]",
+                      "bastion": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion)]",
+                      "bastionNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "bastionPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "containerAppsEnvironment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment)]",
+                      "containerAppsEnvironmentNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment))]",
+                      "containerRegistry": "[take(toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')), 50)]",
+                      "containerRegistryPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "containerRegistryUserAssignedIdentity": "[format('{0}-{1}-AcrPull', variables('naming').resourceTypeAbbreviations.managedIdentity, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "redisCache": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache)]",
+                      "redisCachePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache))]",
+                      "openAiAccount": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cognitiveAccount)]",
+                      "openAiDeployment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.openAiDeployment)]",
+                      "cosmosDbNoSql": "[toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44))]",
+                      "cosmosDbNoSqlPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44)))]",
+                      "frontDoorProfile": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "keyVault": "[if(endsWith(variables('keyVaultName'), '-'), take(variables('keyVaultName'), 23), variables('keyVaultName'))]",
+                      "keyVaultPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault))]",
+                      "logAnalyticsWorkspace": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.logAnalyticsWorkspace)]",
+                      "routeTable": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.routeTable)]",
+                      "serviceBus": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus)]",
+                      "serviceBusPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus))]",
+                      "storageAccount": "[toLower(take(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount), '-', ''), 24))]",
+                      "storageAccountPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount)))]",
+                      "vmJumpBox": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine)]",
+                      "vmJumpBoxNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "vmJumpBoxNic": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkInterface, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "frontDoor": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "azureAISearch": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch)]",
+                      "azureAISearchPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch))]",
+                      "documentIntelligence": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence)]",
+                      "documentIntelligencePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence))]",
+                      "eventGridSystemTopic": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic)]",
+                      "eventGridSystemTopicPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic))]",
+                      "eventGridSubscription": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSubscription)]"
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourcesNames": {
+                      "type": "object",
+                      "value": "[variables('resourceNames')]"
+                    },
+                    "resourceTypeAbbreviations": {
+                      "type": "object",
+                      "value": "[variables('resourceTypeAbbreviations')]"
+                    }
+                  }
+                }
+              },
+              "metadata": {
+                "description": "User-configured naming rules"
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('containerRegistryModule-{0}', uniqueString(resourceGroup().id))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "containerRegistryName": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.containerRegistry]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "spokeVNetId": {
+                    "value": "[parameters('spokeVNetId')]"
+                  },
+                  "hubVNetId": {
+                    "value": "[parameters('hubVNetId')]"
+                  },
+                  "spokePrivateEndpointSubnetName": {
+                    "value": "[parameters('spokePrivateEndpointSubnetName')]"
+                  },
+                  "containerRegistryPrivateEndpointName": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.containerRegistryPep]"
+                  },
+                  "containerRegistryUserAssignedIdentityName": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.containerRegistryUserAssignedIdentity]"
+                  },
+                  "diagnosticWorkspaceId": {
+                    "value": "[parameters('logAnalyticsWorkspaceId')]"
+                  },
+                  "deployZoneRedundantResources": {
+                    "value": "[parameters('deployZoneRedundantResources')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "1772796700946624265"
+                    }
+                  },
+                  "parameters": {
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "The location where the resources will be created."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the container registry."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The tags to be assigned to the created resources."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Whether to enable deplotment telemetry."
+                      }
+                    },
+                    "hubVNetId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The resource ID of the Hub Virtual Network."
+                      }
+                    },
+                    "spokeVNetId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the VNet to which the private endpoint will be connected."
+                      }
+                    },
+                    "spokePrivateEndpointSubnetName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the subnet in the VNet to which the private endpoint will be connected."
+                      }
+                    },
+                    "containerRegistryPrivateEndpointName": {
+                      "type": "string",
+                      "defaultValue": "acr-pep",
+                      "metadata": {
+                        "description": "Optional. The name of the private endpoint to be created for Azure Container Registry. If left empty, it defaults to \"<resourceName>-pep"
+                      }
+                    },
+                    "containerRegistryUserAssignedIdentityName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the user assigned identity to be created to pull image from Azure Container Registry."
+                      }
+                    },
+                    "diagnosticWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the diagnostic log analytics workspace."
+                      }
+                    },
+                    "deployZoneRedundantResources": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "acrDnsZoneName": "privatelink.azurecr.io",
+                    "spokeVNetIdTokens": "[split(parameters('spokeVNetId'), '/')]",
+                    "spokeSubscriptionId": "[variables('spokeVNetIdTokens')[2]]",
+                    "spokeResourceGroupName": "[variables('spokeVNetIdTokens')[4]]",
+                    "spokeVNetName": "[variables('spokeVNetIdTokens')[8]]",
+                    "containerRegistryPullRoleGuid": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
+                    "virtualNetworkLinks": "[concat(createArray(createObject('virtualNetworkResourceId', parameters('spokeVNetId'), 'registrationEnabled', false())), if(not(empty(parameters('hubVNetId'))), createArray(createObject('virtualNetworkResourceId', parameters('hubVNetId'), 'registrationEnabled', false())), createArray()))]"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[parameters('containerRegistryUserAssignedIdentityName')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('containerRegistryUserAssignedIdentityName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.26.54.24096",
+                              "templateHash": "998408512764899332"
+                            },
+                            "name": "User Assigned Identities",
+                            "description": "This module deploys a User Assigned Identity.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "federatedIdentityCredentialsType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the federated identity credential."
+                                    }
+                                  },
+                                  "audiences": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "metadata": {
+                                      "description": "Required. The list of audiences that can appear in the issued token."
+                                    }
+                                  },
+                                  "issuer": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The URL of the issuer to be trusted."
+                                    }
+                                  },
+                                  "subject": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The identifier of the external identity."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the User Assigned Identity."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "federatedIdentityCredentials": {
+                              "$ref": "#/definitions/federatedIdentityCredentialsType",
+                              "metadata": {
+                                "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]",
+                              "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.2.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "userAssignedIdentity": {
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                              "apiVersion": "2023-01-31",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]"
+                            },
+                            "userAssignedIdentity_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "userAssignedIdentity"
+                              ]
+                            },
+                            "userAssignedIdentity_roleAssignments": {
+                              "copy": {
+                                "name": "userAssignedIdentity_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "userAssignedIdentity"
+                              ]
+                            },
+                            "userAssignedIdentity_federatedIdentityCredentials": {
+                              "copy": {
+                                "name": "userAssignedIdentity_federatedIdentityCredentials",
+                                "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]",
+                                "mode": "serial",
+                                "batchSize": 1
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-UserMSI-FederatedIdentityCredential-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]"
+                                  },
+                                  "userAssignedIdentityName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "audiences": {
+                                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]"
+                                  },
+                                  "issuer": {
+                                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]"
+                                  },
+                                  "subject": {
+                                    "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.26.54.24096",
+                                      "templateHash": "4317497001099502136"
+                                    },
+                                    "name": "User Assigned Identity Federated Identity Credential",
+                                    "description": "This module deploys a User Assigned Identity Federated Identity Credential.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "userAssignedIdentityName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the secret."
+                                      }
+                                    },
+                                    "audiences": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
+                                      }
+                                    },
+                                    "issuer": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
+                                      }
+                                    },
+                                    "subject": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+                                      "apiVersion": "2023-01-31",
+                                      "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
+                                      "properties": {
+                                        "audiences": "[parameters('audiences')]",
+                                        "issuer": "[parameters('issuer')]",
+                                        "subject": "[parameters('subject')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the federated identity credential."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the federated identity credential."
+                                      },
+                                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the federated identity credential was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "userAssignedIdentity"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the user assigned identity."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the user assigned identity."
+                              },
+                              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
+                            },
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID (object ID) of the user assigned identity."
+                              },
+                              "value": "[reference('userAssignedIdentity').principalId]"
+                            },
+                            "clientId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The client ID (application ID) of the user assigned identity."
+                              },
+                              "value": "[reference('userAssignedIdentity').clientId]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the user assigned identity was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('userAssignedIdentity', '2023-01-31', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('acrDnsZoneDeployment-{0}', uniqueString(resourceGroup().id))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[variables('acrDnsZoneName')]"
+                          },
+                          "location": {
+                            "value": "global"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "virtualNetworkLinks": {
+                            "value": "[variables('virtualNetworkLinks')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "11412633288570781407"
+                            },
+                            "name": "Private DNS Zones",
+                            "description": "This module deploys a Private DNS zone.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "aType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "aRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipv4Address": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IPv4 address of this A record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of A records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "aaaaType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "aaaaRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipv6Address": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IPv6 address of this AAAA record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of AAAA records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "cnameType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "cnameRecord": {
+                                    "type": "object",
+                                    "properties": {
+                                      "cname": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The canonical name of the CNAME record."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The CNAME record in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "mxType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "mxRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "exchange": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The domain name of the mail host for this MX record."
+                                          }
+                                        },
+                                        "preference": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The preference value for this MX record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of MX records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "ptrType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "ptrRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ptrdname": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The PTR target domain name for this PTR record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of PTR records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "soaType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "soaRecord": {
+                                    "type": "object",
+                                    "properties": {
+                                      "email": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The email contact for this SOA record."
+                                        }
+                                      },
+                                      "expireTime": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The expire time for this SOA record."
+                                        }
+                                      },
+                                      "host": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The domain name of the authoritative name server for this SOA record."
+                                        }
+                                      },
+                                      "minimumTtl": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                                        }
+                                      },
+                                      "refreshTime": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The refresh value for this SOA record."
+                                        }
+                                      },
+                                      "retryTime": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The retry time for this SOA record."
+                                        }
+                                      },
+                                      "serialNumber": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The serial number for this SOA record."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The SOA record in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "srvType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "srvRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "priority": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The priority value for this SRV record."
+                                          }
+                                        },
+                                        "weight": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The weight value for this SRV record."
+                                          }
+                                        },
+                                        "port": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The port value for this SRV record."
+                                          }
+                                        },
+                                        "target": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The target domain name for this SRV record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of SRV records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "txtType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "txtRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "value": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The text value of this TXT record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of TXT records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Private DNS zone name."
+                              }
+                            },
+                            "a": {
+                              "$ref": "#/definitions/aType",
+                              "metadata": {
+                                "description": "Optional. Array of A records."
+                              }
+                            },
+                            "aaaa": {
+                              "$ref": "#/definitions/aaaaType",
+                              "metadata": {
+                                "description": "Optional. Array of AAAA records."
+                              }
+                            },
+                            "cname": {
+                              "$ref": "#/definitions/cnameType",
+                              "metadata": {
+                                "description": "Optional. Array of CNAME records."
+                              }
+                            },
+                            "mx": {
+                              "$ref": "#/definitions/mxType",
+                              "metadata": {
+                                "description": "Optional. Array of MX records."
+                              }
+                            },
+                            "ptr": {
+                              "$ref": "#/definitions/ptrType",
+                              "metadata": {
+                                "description": "Optional. Array of PTR records."
+                              }
+                            },
+                            "soa": {
+                              "$ref": "#/definitions/soaType",
+                              "metadata": {
+                                "description": "Optional. Array of SOA records."
+                              }
+                            },
+                            "srv": {
+                              "$ref": "#/definitions/srvType",
+                              "metadata": {
+                                "description": "Optional. Array of SRV records."
+                              }
+                            },
+                            "txt": {
+                              "$ref": "#/definitions/txtType",
+                              "metadata": {
+                                "description": "Optional. Array of TXT records."
+                              }
+                            },
+                            "virtualNetworkLinks": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "global",
+                              "metadata": {
+                                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]"
+                            },
+                            "privateDnsZone_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_roleAssignments": {
+                              "copy": {
+                                "name": "privateDnsZone_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_A": {
+                              "copy": {
+                                "name": "privateDnsZone_A",
+                                "count": "[length(coalesce(parameters('a'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                                  },
+                                  "aRecords": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8657463061873174631"
+                                    },
+                                    "name": "Private DNS Zone A record",
+                                    "description": "This module deploys a Private DNS Zone A record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the A record."
+                                      }
+                                    },
+                                    "aRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of A records in the record set."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "A": {
+                                      "type": "Microsoft.Network/privateDnsZones/A",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "aRecords": "[parameters('aRecords')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "A_roleAssignments": {
+                                      "copy": {
+                                        "name": "A_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "A"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed A record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed A record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed A record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_AAAA": {
+                              "copy": {
+                                "name": "privateDnsZone_AAAA",
+                                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                                  },
+                                  "aaaaRecords": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "1725749611610769138"
+                                    },
+                                    "name": "Private DNS Zone AAAA record",
+                                    "description": "This module deploys a Private DNS Zone AAAA record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the AAAA record."
+                                      }
+                                    },
+                                    "aaaaRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of AAAA records in the record set."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "AAAA": {
+                                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "AAAA_roleAssignments": {
+                                      "copy": {
+                                        "name": "AAAA_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "AAAA"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed AAAA record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed AAAA record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed AAAA record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_CNAME": {
+                              "copy": {
+                                "name": "privateDnsZone_CNAME",
+                                "count": "[length(coalesce(parameters('cname'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                                  },
+                                  "cnameRecord": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "12750497126800708872"
+                                    },
+                                    "name": "Private DNS Zone CNAME record",
+                                    "description": "This module deploys a Private DNS Zone CNAME record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the CNAME record."
+                                      }
+                                    },
+                                    "cnameRecord": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A CNAME record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "CNAME": {
+                                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "cnameRecord": "[parameters('cnameRecord')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "CNAME_roleAssignments": {
+                                      "copy": {
+                                        "name": "CNAME_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "CNAME"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed CNAME record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed CNAME record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed CNAME record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_MX": {
+                              "copy": {
+                                "name": "privateDnsZone_MX",
+                                "count": "[length(coalesce(parameters('mx'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "mxRecords": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "13512848802819943036"
+                                    },
+                                    "name": "Private DNS Zone MX record",
+                                    "description": "This module deploys a Private DNS Zone MX record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the MX record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "mxRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of MX records in the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "MX": {
+                                      "type": "Microsoft.Network/privateDnsZones/MX",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "mxRecords": "[parameters('mxRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "MX_roleAssignments": {
+                                      "copy": {
+                                        "name": "MX_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "MX"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed MX record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed MX record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed MX record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_PTR": {
+                              "copy": {
+                                "name": "privateDnsZone_PTR",
+                                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ptrRecords": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "5069219418696231980"
+                                    },
+                                    "name": "Private DNS Zone PTR record",
+                                    "description": "This module deploys a Private DNS Zone PTR record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the PTR record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ptrRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of PTR records in the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "PTR": {
+                                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "ptrRecords": "[parameters('ptrRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "PTR_roleAssignments": {
+                                      "copy": {
+                                        "name": "PTR_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "PTR"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed PTR record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed PTR record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed PTR record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_SOA": {
+                              "copy": {
+                                "name": "privateDnsZone_SOA",
+                                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "soaRecord": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8649693365938652763"
+                                    },
+                                    "name": "Private DNS Zone SOA record",
+                                    "description": "This module deploys a Private DNS Zone SOA record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the SOA record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "soaRecord": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A SOA record."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "SOA": {
+                                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "soaRecord": "[parameters('soaRecord')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "SOA_roleAssignments": {
+                                      "copy": {
+                                        "name": "SOA_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "SOA"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed SOA record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed SOA record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed SOA record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_SRV": {
+                              "copy": {
+                                "name": "privateDnsZone_SRV",
+                                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "srvRecords": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "1580431299497536987"
+                                    },
+                                    "name": "Private DNS Zone SRV record",
+                                    "description": "This module deploys a Private DNS Zone SRV record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the SRV record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "srvRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of SRV records in the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "SRV": {
+                                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "srvRecords": "[parameters('srvRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "SRV_roleAssignments": {
+                                      "copy": {
+                                        "name": "SRV_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "SRV"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed SRV record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed SRV record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed SRV record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_TXT": {
+                              "copy": {
+                                "name": "privateDnsZone_TXT",
+                                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "txtRecords": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "1628766837655887758"
+                                    },
+                                    "name": "Private DNS Zone TXT record",
+                                    "description": "This module deploys a Private DNS Zone TXT record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the TXT record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "txtRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of TXT records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "TXT": {
+                                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]",
+                                        "txtRecords": "[parameters('txtRecords')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "TXT_roleAssignments": {
+                                      "copy": {
+                                        "name": "TXT_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "TXT"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed TXT record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed TXT record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed TXT record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_virtualNetworkLinks": {
+                              "copy": {
+                                "name": "privateDnsZone_virtualNetworkLinks",
+                                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                                  },
+                                  "virtualNetworkResourceId": {
+                                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                                  },
+                                  "registrationEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8423159394395901832"
+                                    },
+                                    "name": "Private DNS Zone Virtual Network Link",
+                                    "description": "This module deploys a Private DNS Zone Virtual Network Link.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the virtual network link."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "global",
+                                      "metadata": {
+                                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "registrationEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                                      }
+                                    },
+                                    "virtualNetworkResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Link to another virtual network resource ID."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "virtualNetworkLink": {
+                                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                                        "virtualNetwork": {
+                                          "id": "[parameters('virtualNetworkResourceId')]"
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed virtual network link."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed virtual network link."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed virtual network link."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('virtualNetworkLink', '2020-06-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private DNS zone was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private DNS zone."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private DNS zone."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('containerRegistry-{0}', uniqueString(resourceGroup().id))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('containerRegistryName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "acrSku": {
+                            "value": "Premium"
+                          },
+                          "publicNetworkAccess": {
+                            "value": "Disabled"
+                          },
+                          "acrAdminUserEnabled": {
+                            "value": false
+                          },
+                          "networkRuleBypassOptions": {
+                            "value": "AzureServices"
+                          },
+                          "zoneRedundancy": "[if(parameters('deployZoneRedundantResources'), createObject('value', 'Enabled'), createObject('value', 'Disabled'))]",
+                          "trustPolicyStatus": {
+                            "value": "enabled"
+                          },
+                          "diagnosticSettings": {
+                            "value": [
+                              {
+                                "name": "acr-log-analytics",
+                                "logCategoriesAndGroups": [
+                                  {
+                                    "categoryGroup": "allLogs"
+                                  }
+                                ],
+                                "metricCategories": [
+                                  {
+                                    "category": "AllMetrics"
+                                  }
+                                ],
+                                "workspaceResourceId": "[parameters('diagnosticWorkspaceId')]"
+                              }
+                            ]
+                          },
+                          "privateEndpoints": {
+                            "value": [
+                              {
+                                "name": "[parameters('containerRegistryPrivateEndpointName')]",
+                                "privateDnsZoneResourceIds": [
+                                  "[reference(resourceId('Microsoft.Resources/deployments', format('acrDnsZoneDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.resourceId.value]"
+                                ],
+                                "subnetResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('spokeSubscriptionId'), variables('spokeResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', variables('spokeVNetName'), parameters('spokePrivateEndpointSubnetName'))]"
+                              }
+                            ]
+                          },
+                          "quarantinePolicyStatus": {
+                            "value": "enabled"
+                          },
+                          "roleAssignments": {
+                            "value": [
+                              {
+                                "principalId": "[reference(resourceId('Microsoft.Resources/deployments', parameters('containerRegistryUserAssignedIdentityName')), '2022-09-01').outputs.principalId.value]",
+                                "principalType": "ServicePrincipal",
+                                "roleDefinitionIdOrName": "[variables('containerRegistryPullRoleGuid')]"
+                              }
+                            ]
+                          },
+                          "softDeletePolicyDays": {
+                            "value": 7
+                          },
+                          "softDeletePolicyStatus": {
+                            "value": "disabled"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "16326657109833349577"
+                            },
+                            "name": "Azure Container Registries (ACR)",
+                            "description": "This module deploys an Azure Container Registry (ACR).",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "managedIdentitiesType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "privateEndpointType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the private endpoint."
+                                    }
+                                  },
+                                  "location": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The location to deploy the private endpoint to."
+                                    }
+                                  },
+                                  "privateLinkServiceConnectionName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the private link connection to create."
+                                    }
+                                  },
+                                  "service": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                                    }
+                                  },
+                                  "subnetResourceId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                    }
+                                  },
+                                  "privateDnsZoneGroupName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                                    }
+                                  },
+                                  "privateDnsZoneResourceIds": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                                    }
+                                  },
+                                  "isManualConnection": {
+                                    "type": "bool",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. If Manual Private Link Connection is required."
+                                    }
+                                  },
+                                  "manualConnectionRequestMessage": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "maxLength": 140,
+                                    "metadata": {
+                                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                    }
+                                  },
+                                  "customDnsConfigs": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Required. Fqdn that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Custom DNS configurations."
+                                    }
+                                  },
+                                  "ipConfigurations": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                    }
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                    }
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                    }
+                                  },
+                                  "lock": {
+                                    "$ref": "#/definitions/lockType",
+                                    "metadata": {
+                                      "description": "Optional. Specify the type of lock."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "tags": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                    }
+                                  },
+                                  "enableTelemetry": {
+                                    "type": "bool",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Enable/Disable usage telemetry for module."
+                                    }
+                                  },
+                                  "resourceGroupName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "metricCategories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "customerManagedKeyType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                },
+                                "keyVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
+                                  }
+                                },
+                                "userAssignedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 5,
+                              "maxLength": 50,
+                              "metadata": {
+                                "description": "Required. Name of your Azure Container Registry."
+                              }
+                            },
+                            "acrAdminUserEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enable admin user that have push / pull permission to the registry."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "acrSku": {
+                              "type": "string",
+                              "defaultValue": "Basic",
+                              "allowedValues": [
+                                "Basic",
+                                "Premium",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Tier of your Azure container registry."
+                              }
+                            },
+                            "exportPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the export policy is enabled or not."
+                              }
+                            },
+                            "quarantinePolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "trustPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "retentionPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "enabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+                              }
+                            },
+                            "retentionPolicyDays": {
+                              "type": "int",
+                              "defaultValue": 15,
+                              "metadata": {
+                                "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
+                              }
+                            },
+                            "azureADAuthenticationAsArmPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "enabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registr is enabled or not. Default is enabled."
+                              }
+                            },
+                            "softDeletePolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Soft Delete policy status. Default is disabled."
+                              }
+                            },
+                            "softDeletePolicyDays": {
+                              "type": "int",
+                              "defaultValue": 7,
+                              "metadata": {
+                                "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
+                              }
+                            },
+                            "dataEndpointEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "networkRuleBypassOptions": {
+                              "type": "string",
+                              "defaultValue": "AzureServices",
+                              "allowedValues": [
+                                "AzureServices",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
+                              }
+                            },
+                            "networkRuleSetDefaultAction": {
+                              "type": "string",
+                              "defaultValue": "Deny",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The default action of allow or deny when no other rules match."
+                              }
+                            },
+                            "networkRuleSetIpRules": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "$ref": "#/definitions/privateEndpointType",
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "zoneRedundancy": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                              }
+                            },
+                            "replications": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. All replications to create."
+                              }
+                            },
+                            "webhooks": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. All webhooks to create."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentitiesType",
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "anonymousPullEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyType",
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition."
+                              }
+                            },
+                            "cacheRules": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of Cache Rules. Note: This is a preview feature ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache#cache-for-acr-preview))."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
+                              "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
+                              "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
+                              "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
+                              "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
+                              "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2023-02-01",
+                              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
+                              "dependsOn": [
+                                "cMKKeyVault"
+                              ]
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2023-02-01",
+                              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+                              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
+                            },
+                            "cMKUserAssignedIdentity": {
+                              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                              "apiVersion": "2023-01-31",
+                              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
+                              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
+                            },
+                            "registry": {
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('acrSku')]"
+                              },
+                              "properties": {
+                                "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
+                                "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
+                                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), reference('cMKKeyVault::cMKKey').keyUriWithVersion))), null())]",
+                                "policies": {
+                                  "azureADAuthenticationAsArmPolicy": {
+                                    "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                                  },
+                                  "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
+                                  "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
+                                  "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
+                                  "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
+                                  "softDeletePolicy": {
+                                    "retentionDays": "[parameters('softDeletePolicyDays')]",
+                                    "status": "[parameters('softDeletePolicyStatus')]"
+                                  }
+                                },
+                                "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
+                                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
+                                "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+                                "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]",
+                                "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
+                              },
+                              "dependsOn": [
+                                "cMKKeyVault",
+                                "cMKUserAssignedIdentity"
+                              ]
+                            },
+                            "registry_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_diagnosticSettings": {
+                              "copy": {
+                                "name": "registry_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_roleAssignments": {
+                              "copy": {
+                                "name": "registry_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_replications": {
+                              "copy": {
+                                "name": "registry_replications",
+                                "count": "[length(coalesce(parameters('replications'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
+                                  },
+                                  "regionEndpointEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+                                  },
+                                  "zoneRedundancy": {
+                                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "13769087012819677314"
+                                    },
+                                    "name": "Azure Container Registry (ACR) Replications",
+                                    "description": "This module deploys an Azure Container Registry (ACR) Replication.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the replication."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "regionEndpointEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                                      }
+                                    },
+                                    "zoneRedundancy": {
+                                      "type": "string",
+                                      "defaultValue": "Disabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2023-06-01-preview",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "replication": {
+                                      "type": "Microsoft.ContainerRegistry/registries/replications",
+                                      "apiVersion": "2023-06-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
+                                        "zoneRedundancy": "[parameters('zoneRedundancy')]"
+                                      },
+                                      "dependsOn": [
+                                        "registry"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the replication."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the replication."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the replication was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('replication', '2023-06-01-preview', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_cacheRules": {
+                              "copy": {
+                                "name": "registry_cacheRules",
+                                "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "sourceRepository": {
+                                    "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name'), replace(replace(coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository, '/', '-'), '.', '-'))]"
+                                  },
+                                  "targetRepository": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                                  },
+                                  "credentialSetResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "9456138761658214484"
+                                    },
+                                    "name": "Container Registries Cache",
+                                    "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache)).",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-')]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the cache rule. Will be dereived from the source repository name if not defined."
+                                      }
+                                    },
+                                    "sourceRepository": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Source repository pulled from upstream."
+                                      }
+                                    },
+                                    "targetRepository": {
+                                      "type": "string",
+                                      "defaultValue": "[parameters('sourceRepository')]",
+                                      "metadata": {
+                                        "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                                      }
+                                    },
+                                    "credentialSetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2023-06-01-preview",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "cacheRule": {
+                                      "type": "Microsoft.ContainerRegistry/registries/cacheRules",
+                                      "apiVersion": "2023-06-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "properties": {
+                                        "sourceRepository": "[parameters('sourceRepository')]",
+                                        "targetRepository": "[parameters('targetRepository')]",
+                                        "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "registry"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The Name of the Cache Rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cache Rule."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cache Rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_webhooks": {
+                              "copy": {
+                                "name": "registry_webhooks",
+                                "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                                  },
+                                  "action": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action'), createArray('chart_delete', 'chart_push', 'delete', 'push', 'quarantine'))]"
+                                  },
+                                  "customHeaders": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
+                                  },
+                                  "scope": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
+                                  },
+                                  "status": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
+                                  },
+                                  "serviceUri": {
+                                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "708950816969162319"
+                                    },
+                                    "name": "Azure Container Registry (ACR) Webhooks",
+                                    "description": "This module deploys an Azure Container Registry (ACR) Webhook.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
+                                      "minLength": 5,
+                                      "maxLength": 50,
+                                      "metadata": {
+                                        "description": "Optional. The name of the registry webhook."
+                                      }
+                                    },
+                                    "serviceUri": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The service URI for the webhook to post notifications."
+                                      }
+                                    },
+                                    "status": {
+                                      "type": "string",
+                                      "defaultValue": "enabled",
+                                      "allowedValues": [
+                                        "disabled",
+                                        "enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The status of the webhook at the time the operation was called."
+                                      }
+                                    },
+                                    "action": {
+                                      "type": "array",
+                                      "defaultValue": [
+                                        "chart_delete",
+                                        "chart_push",
+                                        "delete",
+                                        "push",
+                                        "quarantine"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "customHeaders": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Custom headers that will be added to the webhook notifications."
+                                      }
+                                    },
+                                    "scope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2023-06-01-preview",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "webhook": {
+                                      "type": "Microsoft.ContainerRegistry/registries/webhooks",
+                                      "apiVersion": "2023-06-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "actions": "[parameters('action')]",
+                                        "customHeaders": "[parameters('customHeaders')]",
+                                        "scope": "[parameters('scope')]",
+                                        "serviceUri": "[parameters('serviceUri')]",
+                                        "status": "[parameters('status')]"
+                                      },
+                                      "dependsOn": [
+                                        "registry"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the webhook."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the webhook."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Azure container registry."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "actions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "The actions of the webhook."
+                                      },
+                                      "value": "[reference('webhook').actions]"
+                                    },
+                                    "status": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The status of the webhook."
+                                      },
+                                      "value": "[reference('webhook').status]"
+                                    },
+                                    "provistioningState": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The provisioning state of the webhook."
+                                      },
+                                      "value": "[reference('webhook').provisioningState]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('webhook', '2023-06-01-preview', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_privateEndpoints": {
+                              "copy": {
+                                "name": "registry_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroupName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                                  },
+                                  "privateDnsZoneResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.25.53.49325",
+                                      "templateHash": "4120048060064073955"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipConfigurationsType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The name of the resource that is unique within a resource group."
+                                            }
+                                          },
+                                          "properties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "groupId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "memberName": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "privateIPAddress": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Properties of private endpoint IP configurations."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnectionsType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The name of the private link service connection."
+                                            }
+                                          },
+                                          "properties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "groupIds": {
+                                                "type": "array",
+                                                "metadata": {
+                                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "privateLinkServiceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of private link service."
+                                                }
+                                              },
+                                              "requestMessage": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Properties of private link service connection."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnectionsType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The name of the private link service connection."
+                                            }
+                                          },
+                                          "properties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "groupIds": {
+                                                "type": "array",
+                                                "metadata": {
+                                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "privateLinkServiceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of private link service."
+                                                }
+                                              },
+                                              "requestMessage": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Properties of private link service connection."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "fqdn": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                                            }
+                                          },
+                                          "ipAddresses": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            },
+                                            "metadata": {
+                                              "description": "Required. A list of private IP addresses of the private endpoint."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "$ref": "#/definitions/ipConfigurationsType",
+                                      "metadata": {
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      }
+                                    },
+                                    "privateDnsZoneGroupName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                                      }
+                                    },
+                                    "privateDnsZoneResourceIds": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      }
+                                    },
+                                    "customDnsConfigs": {
+                                      "$ref": "#/definitions/customDnsConfigType",
+                                      "metadata": {
+                                        "description": "Optional. Custom DNS configurations."
+                                      }
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                                      "metadata": {
+                                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                                      }
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                                      "metadata": {
+                                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2023-07-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2023-04-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                                          },
+                                          "privateDNSResourceIds": {
+                                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.25.53.49325",
+                                              "templateHash": "11244630631275470040"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                                            "owner": "Azure/module-maintainers"
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDNSResourceIds": {
+                                              "type": "array",
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "privateDnsZoneConfigs",
+                                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                                "input": {
+                                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                                  "properties": {
+                                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                                  }
+                                                }
+                                              }
+                                            ]
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2023-04-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the Azure container registry."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "loginServer": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The reference to the Azure container registry."
+                              },
+                              "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2019-05-01').loginServer]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Azure container registry."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Azure container registry."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId'), '')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('registry', '2023-06-01-preview', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Resources/deployments', format('acrDnsZoneDeployment-{0}', uniqueString(resourceGroup().id)))]",
+                        "[resourceId('Microsoft.Resources/deployments', parameters('containerRegistryUserAssignedIdentityName'))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "containerRegistryId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the container registry."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistry-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.resourceId.value]"
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the container registry."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistry-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.name.value]"
+                    },
+                    "containerRegistryLoginServer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the container registry login server."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistry-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.loginServer.value]"
+                    },
+                    "containerRegistryUserAssignedIdentityId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the user assigned managed identity for the container registry to be able to pull images from it."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', parameters('containerRegistryUserAssignedIdentityName')), '2022-09-01').outputs.resourceId.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "Azure Container Registry, where all workload images should be pulled from."
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('keyVault-{0}', uniqueString(resourceGroup().id))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "keyVaultName": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.keyVault]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "spokeVNetId": {
+                    "value": "[parameters('spokeVNetId')]"
+                  },
+                  "hubVNetId": {
+                    "value": "[parameters('hubVNetId')]"
+                  },
+                  "spokePrivateEndpointSubnetName": {
+                    "value": "[parameters('spokePrivateEndpointSubnetName')]"
+                  },
+                  "keyVaultPrivateEndpointName": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.keyVaultPep]"
+                  },
+                  "diagnosticWorkspaceId": {
+                    "value": "[parameters('logAnalyticsWorkspaceId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "16272877246531333695"
+                    }
+                  },
+                  "parameters": {
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "The location where the resources will be created."
+                      }
+                    },
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Key Vault."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The tags to be assigned to the created resources."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Whether to enable deplotment telemetry."
+                      }
+                    },
+                    "hubVNetId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Hub Virtual Network."
+                      }
+                    },
+                    "spokeVNetId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the VNet to which the private endpoint will be connected."
+                      }
+                    },
+                    "spokePrivateEndpointSubnetName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the subnet in the VNet to which the private endpoint will be connected."
+                      }
+                    },
+                    "keyVaultPrivateEndpointName": {
+                      "type": "string",
+                      "defaultValue": "keyvault-pep",
+                      "metadata": {
+                        "description": "Optional. The name of the private endpoint to be created for Key Vault. If left empty, it defaults to \"<resourceName>-pep"
+                      }
+                    },
+                    "diagnosticWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace."
+                      }
+                    },
+                    "diagnosticSettingsName": {
+                      "type": "string",
+                      "defaultValue": "keyvault-diagnosticSettings",
+                      "metadata": {
+                        "description": "Optional. The name of the diagnostic setting, if deployed. If left empty, it defaults to \"<resourceName>-diagnosticSettings\"."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "vaultDnsZoneName": "privatelink.vaultcore.azure.net",
+                    "spokeVNetIdTokens": "[split(parameters('spokeVNetId'), '/')]",
+                    "spokeSubscriptionId": "[variables('spokeVNetIdTokens')[2]]",
+                    "spokeResourceGroupName": "[variables('spokeVNetIdTokens')[4]]",
+                    "spokeVNetName": "[variables('spokeVNetIdTokens')[8]]",
+                    "virtualNetworkLinks": "[concat(createArray(createObject('virtualNetworkResourceId', parameters('spokeVNetId'), 'registrationEnabled', false())), if(not(empty(parameters('hubVNetId'))), createArray(createObject('virtualNetworkResourceId', parameters('hubVNetId'), 'registrationEnabled', false())), createArray()))]"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('keyvaultDnsZoneDeployment-{0}', uniqueString(resourceGroup().id))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[variables('vaultDnsZoneName')]"
+                          },
+                          "location": {
+                            "value": "global"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "virtualNetworkLinks": {
+                            "value": "[variables('virtualNetworkLinks')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "11412633288570781407"
+                            },
+                            "name": "Private DNS Zones",
+                            "description": "This module deploys a Private DNS zone.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "aType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "aRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipv4Address": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IPv4 address of this A record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of A records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "aaaaType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "aaaaRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipv6Address": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IPv6 address of this AAAA record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of AAAA records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "cnameType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "cnameRecord": {
+                                    "type": "object",
+                                    "properties": {
+                                      "cname": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The canonical name of the CNAME record."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The CNAME record in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "mxType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "mxRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "exchange": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The domain name of the mail host for this MX record."
+                                          }
+                                        },
+                                        "preference": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The preference value for this MX record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of MX records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "ptrType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "ptrRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ptrdname": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The PTR target domain name for this PTR record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of PTR records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "soaType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "soaRecord": {
+                                    "type": "object",
+                                    "properties": {
+                                      "email": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The email contact for this SOA record."
+                                        }
+                                      },
+                                      "expireTime": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The expire time for this SOA record."
+                                        }
+                                      },
+                                      "host": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The domain name of the authoritative name server for this SOA record."
+                                        }
+                                      },
+                                      "minimumTtl": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                                        }
+                                      },
+                                      "refreshTime": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The refresh value for this SOA record."
+                                        }
+                                      },
+                                      "retryTime": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The retry time for this SOA record."
+                                        }
+                                      },
+                                      "serialNumber": {
+                                        "type": "int",
+                                        "metadata": {
+                                          "description": "Required. The serial number for this SOA record."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The SOA record in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "srvType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "srvRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "priority": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The priority value for this SRV record."
+                                          }
+                                        },
+                                        "weight": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The weight value for this SRV record."
+                                          }
+                                        },
+                                        "port": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The port value for this SRV record."
+                                          }
+                                        },
+                                        "target": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The target domain name for this SRV record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of SRV records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "txtType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the record."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata of the record."
+                                    }
+                                  },
+                                  "ttl": {
+                                    "type": "int",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The TTL of the record."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "txtRecords": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "value": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The text value of this TXT record."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The list of TXT records in the record set."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Private DNS zone name."
+                              }
+                            },
+                            "a": {
+                              "$ref": "#/definitions/aType",
+                              "metadata": {
+                                "description": "Optional. Array of A records."
+                              }
+                            },
+                            "aaaa": {
+                              "$ref": "#/definitions/aaaaType",
+                              "metadata": {
+                                "description": "Optional. Array of AAAA records."
+                              }
+                            },
+                            "cname": {
+                              "$ref": "#/definitions/cnameType",
+                              "metadata": {
+                                "description": "Optional. Array of CNAME records."
+                              }
+                            },
+                            "mx": {
+                              "$ref": "#/definitions/mxType",
+                              "metadata": {
+                                "description": "Optional. Array of MX records."
+                              }
+                            },
+                            "ptr": {
+                              "$ref": "#/definitions/ptrType",
+                              "metadata": {
+                                "description": "Optional. Array of PTR records."
+                              }
+                            },
+                            "soa": {
+                              "$ref": "#/definitions/soaType",
+                              "metadata": {
+                                "description": "Optional. Array of SOA records."
+                              }
+                            },
+                            "srv": {
+                              "$ref": "#/definitions/srvType",
+                              "metadata": {
+                                "description": "Optional. Array of SRV records."
+                              }
+                            },
+                            "txt": {
+                              "$ref": "#/definitions/txtType",
+                              "metadata": {
+                                "description": "Optional. Array of TXT records."
+                              }
+                            },
+                            "virtualNetworkLinks": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "global",
+                              "metadata": {
+                                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]"
+                            },
+                            "privateDnsZone_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_roleAssignments": {
+                              "copy": {
+                                "name": "privateDnsZone_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_A": {
+                              "copy": {
+                                "name": "privateDnsZone_A",
+                                "count": "[length(coalesce(parameters('a'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                                  },
+                                  "aRecords": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8657463061873174631"
+                                    },
+                                    "name": "Private DNS Zone A record",
+                                    "description": "This module deploys a Private DNS Zone A record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the A record."
+                                      }
+                                    },
+                                    "aRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of A records in the record set."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "A": {
+                                      "type": "Microsoft.Network/privateDnsZones/A",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "aRecords": "[parameters('aRecords')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "A_roleAssignments": {
+                                      "copy": {
+                                        "name": "A_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "A"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed A record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed A record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed A record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_AAAA": {
+                              "copy": {
+                                "name": "privateDnsZone_AAAA",
+                                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                                  },
+                                  "aaaaRecords": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "1725749611610769138"
+                                    },
+                                    "name": "Private DNS Zone AAAA record",
+                                    "description": "This module deploys a Private DNS Zone AAAA record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the AAAA record."
+                                      }
+                                    },
+                                    "aaaaRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of AAAA records in the record set."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "AAAA": {
+                                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "AAAA_roleAssignments": {
+                                      "copy": {
+                                        "name": "AAAA_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "AAAA"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed AAAA record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed AAAA record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed AAAA record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_CNAME": {
+                              "copy": {
+                                "name": "privateDnsZone_CNAME",
+                                "count": "[length(coalesce(parameters('cname'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                                  },
+                                  "cnameRecord": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "12750497126800708872"
+                                    },
+                                    "name": "Private DNS Zone CNAME record",
+                                    "description": "This module deploys a Private DNS Zone CNAME record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the CNAME record."
+                                      }
+                                    },
+                                    "cnameRecord": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A CNAME record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "CNAME": {
+                                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "cnameRecord": "[parameters('cnameRecord')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "CNAME_roleAssignments": {
+                                      "copy": {
+                                        "name": "CNAME_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "CNAME"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed CNAME record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed CNAME record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed CNAME record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_MX": {
+                              "copy": {
+                                "name": "privateDnsZone_MX",
+                                "count": "[length(coalesce(parameters('mx'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "mxRecords": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "13512848802819943036"
+                                    },
+                                    "name": "Private DNS Zone MX record",
+                                    "description": "This module deploys a Private DNS Zone MX record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the MX record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "mxRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of MX records in the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "MX": {
+                                      "type": "Microsoft.Network/privateDnsZones/MX",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "mxRecords": "[parameters('mxRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "MX_roleAssignments": {
+                                      "copy": {
+                                        "name": "MX_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "MX"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed MX record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed MX record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed MX record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_PTR": {
+                              "copy": {
+                                "name": "privateDnsZone_PTR",
+                                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ptrRecords": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "5069219418696231980"
+                                    },
+                                    "name": "Private DNS Zone PTR record",
+                                    "description": "This module deploys a Private DNS Zone PTR record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the PTR record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ptrRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of PTR records in the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "PTR": {
+                                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "ptrRecords": "[parameters('ptrRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "PTR_roleAssignments": {
+                                      "copy": {
+                                        "name": "PTR_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "PTR"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed PTR record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed PTR record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed PTR record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_SOA": {
+                              "copy": {
+                                "name": "privateDnsZone_SOA",
+                                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "soaRecord": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8649693365938652763"
+                                    },
+                                    "name": "Private DNS Zone SOA record",
+                                    "description": "This module deploys a Private DNS Zone SOA record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the SOA record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "soaRecord": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A SOA record."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "SOA": {
+                                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "soaRecord": "[parameters('soaRecord')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "SOA_roleAssignments": {
+                                      "copy": {
+                                        "name": "SOA_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "SOA"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed SOA record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed SOA record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed SOA record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_SRV": {
+                              "copy": {
+                                "name": "privateDnsZone_SRV",
+                                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "srvRecords": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "1580431299497536987"
+                                    },
+                                    "name": "Private DNS Zone SRV record",
+                                    "description": "This module deploys a Private DNS Zone SRV record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the SRV record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "srvRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of SRV records in the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "SRV": {
+                                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "srvRecords": "[parameters('srvRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "SRV_roleAssignments": {
+                                      "copy": {
+                                        "name": "SRV_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "SRV"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed SRV record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed SRV record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed SRV record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_TXT": {
+                              "copy": {
+                                "name": "privateDnsZone_TXT",
+                                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "txtRecords": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "1628766837655887758"
+                                    },
+                                    "name": "Private DNS Zone TXT record",
+                                    "description": "This module deploys a Private DNS Zone TXT record.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the TXT record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The metadata attached to the record set."
+                                      }
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "txtRecords": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of TXT records in the record set."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "TXT": {
+                                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]",
+                                        "txtRecords": "[parameters('txtRecords')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    },
+                                    "TXT_roleAssignments": {
+                                      "copy": {
+                                        "name": "TXT_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "TXT"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed TXT record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed TXT record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed TXT record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_virtualNetworkLinks": {
+                              "copy": {
+                                "name": "privateDnsZone_virtualNetworkLinks",
+                                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                                  },
+                                  "virtualNetworkResourceId": {
+                                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                                  },
+                                  "registrationEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8423159394395901832"
+                                    },
+                                    "name": "Private DNS Zone Virtual Network Link",
+                                    "description": "This module deploys a Private DNS Zone Virtual Network Link.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the virtual network link."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "global",
+                                      "metadata": {
+                                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "registrationEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                                      }
+                                    },
+                                    "virtualNetworkResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Link to another virtual network resource ID."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "virtualNetworkLink": {
+                                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                                        "virtualNetwork": {
+                                          "id": "[parameters('virtualNetworkResourceId')]"
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateDnsZone"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed virtual network link."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed virtual network link."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed virtual network link."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('virtualNetworkLink', '2020-06-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private DNS zone was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private DNS zone."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private DNS zone."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('vault-{0}', uniqueString(resourceGroup().id))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('keyVaultName')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "sku": {
+                            "value": "standard"
+                          },
+                          "networkAcls": {
+                            "value": {
+                              "bypass": "AzureServices",
+                              "defaultAction": "Deny"
+                            }
+                          },
+                          "enableSoftDelete": {
+                            "value": true
+                          },
+                          "softDeleteRetentionInDays": {
+                            "value": 7
+                          },
+                          "enablePurgeProtection": {
+                            "value": null
+                          },
+                          "publicNetworkAccess": {
+                            "value": "Disabled"
+                          },
+                          "enableRbacAuthorization": {
+                            "value": true
+                          },
+                          "enableVaultForDeployment": {
+                            "value": true
+                          },
+                          "privateEndpoints": {
+                            "value": [
+                              {
+                                "name": "[parameters('keyVaultPrivateEndpointName')]",
+                                "privateDnsZoneResourceIds": [
+                                  "[reference(resourceId('Microsoft.Resources/deployments', format('keyvaultDnsZoneDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.resourceId.value]"
+                                ],
+                                "subnetResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('spokeSubscriptionId'), variables('spokeResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', variables('spokeVNetName'), parameters('spokePrivateEndpointSubnetName'))]"
+                              }
+                            ]
+                          },
+                          "diagnosticSettings": {
+                            "value": [
+                              {
+                                "name": "[parameters('diagnosticSettingsName')]",
+                                "workspaceResourceId": "[parameters('diagnosticWorkspaceId')]",
+                                "logCategoriesAndGroups": [
+                                  {
+                                    "categoryGroup": "allLogs"
+                                  }
+                                ],
+                                "metricCategories": [
+                                  {
+                                    "category": "AllMetrics"
+                                  }
+                                ]
+                              }
+                            ]
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "4424685997744462747"
+                            },
+                            "name": "Key Vaults",
+                            "description": "This module deploys a Key Vault.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "metricCategories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "privateEndpointType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the private endpoint."
+                                    }
+                                  },
+                                  "location": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The location to deploy the private endpoint to."
+                                    }
+                                  },
+                                  "privateLinkServiceConnectionName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the private link connection to create."
+                                    }
+                                  },
+                                  "service": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                                    }
+                                  },
+                                  "subnetResourceId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                    }
+                                  },
+                                  "privateDnsZoneGroupName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                                    }
+                                  },
+                                  "privateDnsZoneResourceIds": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                                    }
+                                  },
+                                  "isManualConnection": {
+                                    "type": "bool",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. If Manual Private Link Connection is required."
+                                    }
+                                  },
+                                  "manualConnectionRequestMessage": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "maxLength": 140,
+                                    "metadata": {
+                                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                    }
+                                  },
+                                  "customDnsConfigs": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Required. Fqdn that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Custom DNS configurations."
+                                    }
+                                  },
+                                  "ipConfigurations": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                    }
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                    }
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                    }
+                                  },
+                                  "lock": {
+                                    "$ref": "#/definitions/lockType",
+                                    "metadata": {
+                                      "description": "Optional. Specify the type of lock."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  },
+                                  "tags": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                    }
+                                  },
+                                  "enableTelemetry": {
+                                    "type": "bool",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Enable/Disable usage telemetry for module."
+                                    }
+                                  },
+                                  "resourceGroupName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "accessPoliciesType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "tenantId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                                    }
+                                  },
+                                  "objectId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                                    }
+                                  },
+                                  "applicationId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Application ID of the client making request on behalf of a principal."
+                                    }
+                                  },
+                                  "permissions": {
+                                    "type": "object",
+                                    "properties": {
+                                      "keys": {
+                                        "type": "array",
+                                        "allowedValues": [
+                                          "all",
+                                          "backup",
+                                          "create",
+                                          "decrypt",
+                                          "delete",
+                                          "encrypt",
+                                          "get",
+                                          "getrotationpolicy",
+                                          "import",
+                                          "list",
+                                          "purge",
+                                          "recover",
+                                          "release",
+                                          "restore",
+                                          "rotate",
+                                          "setrotationpolicy",
+                                          "sign",
+                                          "unwrapKey",
+                                          "update",
+                                          "verify",
+                                          "wrapKey"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Permissions to keys."
+                                        }
+                                      },
+                                      "secrets": {
+                                        "type": "array",
+                                        "allowedValues": [
+                                          "all",
+                                          "backup",
+                                          "delete",
+                                          "get",
+                                          "list",
+                                          "purge",
+                                          "recover",
+                                          "restore",
+                                          "set"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Permissions to secrets."
+                                        }
+                                      },
+                                      "certificates": {
+                                        "type": "array",
+                                        "allowedValues": [
+                                          "all",
+                                          "backup",
+                                          "create",
+                                          "delete",
+                                          "deleteissuers",
+                                          "get",
+                                          "getissuers",
+                                          "import",
+                                          "list",
+                                          "listissuers",
+                                          "managecontacts",
+                                          "manageissuers",
+                                          "purge",
+                                          "recover",
+                                          "restore",
+                                          "setissuers",
+                                          "update"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Permissions to certificates."
+                                        }
+                                      },
+                                      "storage": {
+                                        "type": "array",
+                                        "allowedValues": [
+                                          "all",
+                                          "backup",
+                                          "delete",
+                                          "deletesas",
+                                          "get",
+                                          "getsas",
+                                          "list",
+                                          "listsas",
+                                          "purge",
+                                          "recover",
+                                          "regeneratekey",
+                                          "restore",
+                                          "set",
+                                          "setsas",
+                                          "update"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Permissions to storage accounts."
+                                        }
+                                      }
+                                    },
+                                    "metadata": {
+                                      "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "secretsType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the secret."
+                                    }
+                                  },
+                                  "tags": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource tags."
+                                    }
+                                  },
+                                  "attributes": {
+                                    "type": "object",
+                                    "properties": {
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Defines whether the secret is enabled or disabled."
+                                        }
+                                      },
+                                      "exp": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                        }
+                                      },
+                                      "nbf": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Contains attributes of the secret."
+                                    }
+                                  },
+                                  "contentType": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The content type of the secret."
+                                    }
+                                  },
+                                  "value": {
+                                    "type": "securestring",
+                                    "metadata": {
+                                      "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "keysType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the key."
+                                    }
+                                  },
+                                  "tags": {
+                                    "type": "object",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource tags."
+                                    }
+                                  },
+                                  "attributes": {
+                                    "type": "object",
+                                    "properties": {
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Defines whether the key is enabled or disabled."
+                                        }
+                                      },
+                                      "exp": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                        }
+                                      },
+                                      "nbf": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Contains attributes of the key."
+                                    }
+                                  },
+                                  "curveName": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "P-256",
+                                      "P-256K",
+                                      "P-384",
+                                      "P-521"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"."
+                                    }
+                                  },
+                                  "keyOps": {
+                                    "type": "array",
+                                    "allowedValues": [
+                                      "decrypt",
+                                      "encrypt",
+                                      "import",
+                                      "release",
+                                      "sign",
+                                      "unwrapKey",
+                                      "verify",
+                                      "wrapKey"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The allowed operations on this key."
+                                    }
+                                  },
+                                  "keySize": {
+                                    "type": "int",
+                                    "allowedValues": [
+                                      2048,
+                                      3072,
+                                      4096
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"."
+                                    }
+                                  },
+                                  "kty": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "EC",
+                                      "EC-HSM",
+                                      "RSA",
+                                      "RSA-HSM"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The type of the key. Default is \"EC\"."
+                                    }
+                                  },
+                                  "releasePolicy": {
+                                    "type": "object",
+                                    "properties": {
+                                      "contentType": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Content type and version of key release policy."
+                                        }
+                                      },
+                                      "data": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Blob encoding the policy rules under which the key can be released."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Key release policy."
+                                    }
+                                  },
+                                  "rotationPolicy": {
+                                    "$ref": "#/definitions/rotationPoliciesType",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Key rotation policy."
+                                    }
+                                  },
+                                  "roleAssignments": {
+                                    "$ref": "#/definitions/roleAssignmentType",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Array of role assignments to create."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "rotationPoliciesType": {
+                              "type": "object",
+                              "properties": {
+                                "attributes": {
+                                  "type": "object",
+                                  "properties": {
+                                    "expiryTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The attributes of key rotation policy."
+                                  }
+                                },
+                                "lifetimeActions": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "action": {
+                                        "type": "object",
+                                        "properties": {
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Notify",
+                                              "Rotate"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The type of action."
+                                            }
+                                          }
+                                        },
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The action of key rotation policy lifetimeAction."
+                                        }
+                                      },
+                                      "trigger": {
+                                        "type": "object",
+                                        "properties": {
+                                          "timeAfterCreate": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                                            }
+                                          },
+                                          "timeBeforeExpiry": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                                            }
+                                          }
+                                        },
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The trigger of key rotation policy lifetimeAction."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lifetimeActions for key rotation action."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Required. Name of the Key Vault. Must be globally unique."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "accessPolicies": {
+                              "$ref": "#/definitions/accessPoliciesType",
+                              "metadata": {
+                                "description": "Optional. All access policies to create."
+                              }
+                            },
+                            "secrets": {
+                              "$ref": "#/definitions/secretsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. All secrets to create."
+                              }
+                            },
+                            "keys": {
+                              "$ref": "#/definitions/keysType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. All keys to create."
+                              }
+                            },
+                            "enableVaultForDeployment": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies if the vault is enabled for deployment by script or compute."
+                              }
+                            },
+                            "enableVaultForTemplateDeployment": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies if the vault is enabled for a template deployment."
+                              }
+                            },
+                            "enableVaultForDiskEncryption": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios."
+                              }
+                            },
+                            "enableSoftDelete": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Switch to enable/disable Key Vault's soft delete feature."
+                              }
+                            },
+                            "softDeleteRetentionInDays": {
+                              "type": "int",
+                              "defaultValue": 90,
+                              "metadata": {
+                                "description": "Optional. softDelete data retention days. It accepts >=7 and <=90."
+                              }
+                            },
+                            "enableRbacAuthorization": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC."
+                              }
+                            },
+                            "createMode": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not. - recover or default."
+                              }
+                            },
+                            "enablePurgeProtection": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature."
+                              }
+                            },
+                            "sku": {
+                              "type": "string",
+                              "defaultValue": "premium",
+                              "allowedValues": [
+                                "premium",
+                                "standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the SKU for the vault."
+                              }
+                            },
+                            "networkAcls": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Rules governing the accessibility of the resource from specific network locations."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "",
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "$ref": "#/definitions/privateEndpointType",
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource tags."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedAccessPolicies",
+                                "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
+                                "input": {
+                                  "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
+                                  "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
+                                  "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
+                                  "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
+                                }
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                              "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
+                              "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]",
+                              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                              "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
+                              "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
+                              "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
+                              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                              "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
+                              "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "keyVault": {
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2022-07-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
+                                "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]",
+                                "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
+                                "enableSoftDelete": "[parameters('enableSoftDelete')]",
+                                "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]",
+                                "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]",
+                                "createMode": "[parameters('createMode')]",
+                                "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]",
+                                "tenantId": "[subscription().tenantId]",
+                                "accessPolicies": "[variables('formattedAccessPolicies')]",
+                                "sku": {
+                                  "name": "[parameters('sku')]",
+                                  "family": "A"
+                                },
+                                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]"
+                              }
+                            },
+                            "keyVault_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            },
+                            "keyVault_diagnosticSettings": {
+                              "copy": {
+                                "name": "keyVault_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            },
+                            "keyVault_roleAssignments": {
+                              "copy": {
+                                "name": "keyVault_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            },
+                            "keyVault_accessPolicies": {
+                              "condition": "[not(empty(parameters('accessPolicies')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "keyVaultName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "accessPolicies": {
+                                    "value": "[parameters('accessPolicies')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "13379419349517171769"
+                                    },
+                                    "name": "Key Vault Access Policies",
+                                    "description": "This module deploys a Key Vault Access Policy.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "accessPoliciesType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "tenantId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                                            }
+                                          },
+                                          "objectId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                                            }
+                                          },
+                                          "applicationId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Application ID of the client making request on behalf of a principal."
+                                            }
+                                          },
+                                          "permissions": {
+                                            "type": "object",
+                                            "properties": {
+                                              "keys": {
+                                                "type": "array",
+                                                "allowedValues": [
+                                                  "all",
+                                                  "backup",
+                                                  "create",
+                                                  "decrypt",
+                                                  "delete",
+                                                  "encrypt",
+                                                  "get",
+                                                  "getrotationpolicy",
+                                                  "import",
+                                                  "list",
+                                                  "purge",
+                                                  "recover",
+                                                  "release",
+                                                  "restore",
+                                                  "rotate",
+                                                  "setrotationpolicy",
+                                                  "sign",
+                                                  "unwrapKey",
+                                                  "update",
+                                                  "verify",
+                                                  "wrapKey"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Permissions to keys."
+                                                }
+                                              },
+                                              "secrets": {
+                                                "type": "array",
+                                                "allowedValues": [
+                                                  "all",
+                                                  "backup",
+                                                  "delete",
+                                                  "get",
+                                                  "list",
+                                                  "purge",
+                                                  "recover",
+                                                  "restore",
+                                                  "set"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Permissions to secrets."
+                                                }
+                                              },
+                                              "certificates": {
+                                                "type": "array",
+                                                "allowedValues": [
+                                                  "all",
+                                                  "backup",
+                                                  "create",
+                                                  "delete",
+                                                  "deleteissuers",
+                                                  "get",
+                                                  "getissuers",
+                                                  "import",
+                                                  "list",
+                                                  "listissuers",
+                                                  "managecontacts",
+                                                  "manageissuers",
+                                                  "purge",
+                                                  "recover",
+                                                  "restore",
+                                                  "setissuers",
+                                                  "update"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Permissions to certificates."
+                                                }
+                                              },
+                                              "storage": {
+                                                "type": "array",
+                                                "allowedValues": [
+                                                  "all",
+                                                  "backup",
+                                                  "delete",
+                                                  "deletesas",
+                                                  "get",
+                                                  "getsas",
+                                                  "list",
+                                                  "listsas",
+                                                  "purge",
+                                                  "recover",
+                                                  "regeneratekey",
+                                                  "restore",
+                                                  "set",
+                                                  "setsas",
+                                                  "update"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Permissions to storage accounts."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "accessPolicies": {
+                                      "$ref": "#/definitions/accessPoliciesType",
+                                      "metadata": {
+                                        "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedAccessPolicies",
+                                        "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
+                                        "input": {
+                                          "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
+                                          "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
+                                          "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
+                                          "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2022-07-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "policies": {
+                                      "type": "Microsoft.KeyVault/vaults/accessPolicies",
+                                      "apiVersion": "2022-07-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]",
+                                      "properties": {
+                                        "accessPolicies": "[variables('formattedAccessPolicies')]"
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the access policies assignment was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the access policies assignment."
+                                      },
+                                      "value": "add"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the access policies assignment."
+                                      },
+                                      "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            },
+                            "keyVault_secrets": {
+                              "copy": {
+                                "name": "keyVault_secrets",
+                                "count": "[length(coalesce(parameters('secrets'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]"
+                                  },
+                                  "value": {
+                                    "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]"
+                                  },
+                                  "keyVaultName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "attributesEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesEnabled')]"
+                                  },
+                                  "attributesExp": {
+                                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesExp')]"
+                                  },
+                                  "attributesNbf": {
+                                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesNbf')]"
+                                  },
+                                  "contentType": {
+                                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "5636875941217257115"
+                                    },
+                                    "name": "Key Vault Secrets",
+                                    "description": "This module deploys a Key Vault Secret.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the secret."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource tags."
+                                      }
+                                    },
+                                    "attributesEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Determines whether the object is enabled."
+                                      }
+                                    },
+                                    "attributesExp": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                                      }
+                                    },
+                                    "attributesNbf": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                                      }
+                                    },
+                                    "contentType": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The content type of the secret."
+                                      }
+                                    },
+                                    "value": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                                      "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
+                                      "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2022-07-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "secret": {
+                                      "type": "Microsoft.KeyVault/vaults/secrets",
+                                      "apiVersion": "2022-07-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "contentType": "[parameters('contentType')]",
+                                        "attributes": {
+                                          "enabled": "[parameters('attributesEnabled')]",
+                                          "exp": "[parameters('attributesExp')]",
+                                          "nbf": "[parameters('attributesNbf')]"
+                                        },
+                                        "value": "[parameters('value')]"
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "secret_roleAssignments": {
+                                      "copy": {
+                                        "name": "secret_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "secret"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the secret."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the secret."
+                                      },
+                                      "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the secret was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            },
+                            "keyVault_keys": {
+                              "copy": {
+                                "name": "keyVault_keys",
+                                "count": "[length(coalesce(parameters('keys'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]"
+                                  },
+                                  "keyVaultName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "attributesEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesEnabled')]"
+                                  },
+                                  "attributesExp": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesExp')]"
+                                  },
+                                  "attributesNbf": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesNbf')]"
+                                  },
+                                  "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]",
+                                  "keyOps": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]"
+                                  },
+                                  "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]",
+                                  "releasePolicy": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]"
+                                  },
+                                  "kty": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "rotationPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "2556304156587722941"
+                                    },
+                                    "name": "Key Vault Keys",
+                                    "description": "This module deploys a Key Vault Key.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the key."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource tags."
+                                      }
+                                    },
+                                    "attributesEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Determines whether the object is enabled."
+                                      }
+                                    },
+                                    "attributesExp": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                                      }
+                                    },
+                                    "attributesNbf": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                                      }
+                                    },
+                                    "curveName": {
+                                      "type": "string",
+                                      "defaultValue": "P-256",
+                                      "allowedValues": [
+                                        "P-256",
+                                        "P-256K",
+                                        "P-384",
+                                        "P-521"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The elliptic curve name."
+                                      }
+                                    },
+                                    "keyOps": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "decrypt",
+                                        "encrypt",
+                                        "import",
+                                        "sign",
+                                        "unwrapKey",
+                                        "verify",
+                                        "wrapKey"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Array of JsonWebKeyOperation."
+                                      }
+                                    },
+                                    "keySize": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA."
+                                      }
+                                    },
+                                    "kty": {
+                                      "type": "string",
+                                      "defaultValue": "EC",
+                                      "allowedValues": [
+                                        "EC",
+                                        "EC-HSM",
+                                        "RSA",
+                                        "RSA-HSM"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The type of the key."
+                                      }
+                                    },
+                                    "releasePolicy": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key release policy."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "rotationPolicy": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key rotation policy properties object."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                                      "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
+                                      "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
+                                      "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
+                                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2022-07-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "key": {
+                                      "type": "Microsoft.KeyVault/vaults/keys",
+                                      "apiVersion": "2022-07-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "attributes": {
+                                          "enabled": "[parameters('attributesEnabled')]",
+                                          "exp": "[parameters('attributesExp')]",
+                                          "nbf": "[parameters('attributesNbf')]"
+                                        },
+                                        "curveName": "[parameters('curveName')]",
+                                        "keyOps": "[parameters('keyOps')]",
+                                        "keySize": "[parameters('keySize')]",
+                                        "kty": "[parameters('kty')]",
+                                        "rotationPolicy": "[coalesce(parameters('rotationPolicy'), createObject())]",
+                                        "release_policy": "[coalesce(parameters('releasePolicy'), createObject())]"
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "key_roleAssignments": {
+                                      "copy": {
+                                        "name": "key_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "key"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the key."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the key."
+                                      },
+                                      "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the key was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            },
+                            "keyVault_privateEndpoints": {
+                              "copy": {
+                                "name": "keyVault_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroupName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                                  },
+                                  "privateDnsZoneResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.25.53.49325",
+                                      "templateHash": "4120048060064073955"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "roleDefinitionIdOrName": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                            }
+                                          },
+                                          "principalId": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                            }
+                                          },
+                                          "principalType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Device",
+                                              "ForeignGroup",
+                                              "Group",
+                                              "ServicePrincipal",
+                                              "User"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The principal type of the assigned principal ID."
+                                            }
+                                          },
+                                          "description": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The description of the role assignment."
+                                            }
+                                          },
+                                          "condition": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                            }
+                                          },
+                                          "conditionVersion": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "2.0"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Version of the condition."
+                                            }
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipConfigurationsType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The name of the resource that is unique within a resource group."
+                                            }
+                                          },
+                                          "properties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "groupId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "memberName": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "privateIPAddress": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Properties of private endpoint IP configurations."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnectionsType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The name of the private link service connection."
+                                            }
+                                          },
+                                          "properties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "groupIds": {
+                                                "type": "array",
+                                                "metadata": {
+                                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "privateLinkServiceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of private link service."
+                                                }
+                                              },
+                                              "requestMessage": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Properties of private link service connection."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnectionsType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. The name of the private link service connection."
+                                            }
+                                          },
+                                          "properties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "groupIds": {
+                                                "type": "array",
+                                                "metadata": {
+                                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                                }
+                                              },
+                                              "privateLinkServiceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of private link service."
+                                                }
+                                              },
+                                              "requestMessage": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                }
+                                              }
+                                            },
+                                            "metadata": {
+                                              "description": "Required. Properties of private link service connection."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigType": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "fqdn": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                                            }
+                                          },
+                                          "ipAddresses": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            },
+                                            "metadata": {
+                                              "description": "Required. A list of private IP addresses of the private endpoint."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "$ref": "#/definitions/ipConfigurationsType",
+                                      "metadata": {
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      }
+                                    },
+                                    "privateDnsZoneGroupName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                                      }
+                                    },
+                                    "privateDnsZoneResourceIds": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "$ref": "#/definitions/roleAssignmentType",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      }
+                                    },
+                                    "customDnsConfigs": {
+                                      "$ref": "#/definitions/customDnsConfigType",
+                                      "metadata": {
+                                        "description": "Optional. Custom DNS configurations."
+                                      }
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                                      "metadata": {
+                                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                                      }
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                                      "metadata": {
+                                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2023-07-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2023-04-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                                      "properties": {
+                                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                                          },
+                                          "privateDNSResourceIds": {
+                                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.25.53.49325",
+                                              "templateHash": "11244630631275470040"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                                            "owner": "Azure/module-maintainers"
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDNSResourceIds": {
+                                              "type": "array",
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "privateDnsZoneConfigs",
+                                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                                "input": {
+                                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                                  "properties": {
+                                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                                  }
+                                                }
+                                              }
+                                            ]
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2023-04-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "keyVault"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the key vault."
+                              },
+                              "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the key vault was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the key vault."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "uri": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The URI of the key vault."
+                              },
+                              "value": "[reference('keyVault').vaultUri]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('keyVault', '2022-07-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Resources/deployments', format('keyvaultDnsZoneDeployment-{0}', uniqueString(resourceGroup().id)))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "keyVaultId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the key vault."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vault-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.resourceId.value]"
+                    },
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the key vault."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vault-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('supportingServicesNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "Azure Key Vault used to hold items like TLS certs and application secrets that your workload will need."
+              }
+            }
+          ],
+          "outputs": {
+            "containerRegistryId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Azure Container Registry."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistryModule-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.containerRegistryId.value]"
+            },
+            "containerRegistryName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Azure Container Registry."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistryModule-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.containerRegistryName.value]"
+            },
+            "containerRegistryLoginServer": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the container registry login server."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistryModule-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.containerRegistryLoginServer.value]"
+            },
+            "containerRegistryUserAssignedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the user-assigned managed identity for the Azure Container Registry to be able to pull images from it."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('containerRegistryModule-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.containerRegistryUserAssignedIdentityId.value]"
+            },
+            "keyVaultResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Azure Key Vault."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('keyVault-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.keyVaultId.value]"
+            },
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Azure Key Vault."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('keyVault-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.keyVaultName.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64))]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)]",
+      "resourceGroup": "[variables('rgSpokeName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "environment": {
+            "value": "[parameters('environment')]"
+          },
+          "workloadName": {
+            "value": "[parameters('workloadName')]"
+          },
+          "hubVNetId": {
+            "value": "[parameters('hubVirtualNetworkResourceId')]"
+          },
+          "spokeVNetName": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeVNetName.value]"
+          },
+          "spokeInfraSubnetName": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeInfraSubnetName.value]"
+          },
+          "enableApplicationInsights": {
+            "value": "[parameters('enableApplicationInsights')]"
+          },
+          "enableDaprInstrumentation": {
+            "value": "[parameters('enableDaprInstrumentation')]"
+          },
+          "containerRegistryUserAssignedIdentityId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerRegistryUserAssignedIdentityId.value]"
+          },
+          "logAnalyticsWorkspaceId": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.logAnalyticsWorkspaceId.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "17883690966843525174"
+            }
+          },
+          "parameters": {
+            "workloadName": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 10,
+              "metadata": {
+                "description": "The name of the workload that is being deployed. Up to 10 characters long."
+              }
+            },
+            "environment": {
+              "type": "string",
+              "maxLength": 8,
+              "metadata": {
+                "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\"). Up to 8 characters long."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "The location where the resources will be created. This needs to be the same region as the spoke."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The tags to be assigned to the created resources."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Whether to enable deplotment telemetry."
+              }
+            },
+            "hubVNetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing hub virtual network."
+              }
+            },
+            "spokeVNetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the existing spoke virtual network."
+              }
+            },
+            "spokeInfraSubnetName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the existing spoke infrastructure subnet."
+              }
+            },
+            "enableApplicationInsights": {
+              "type": "bool",
+              "metadata": {
+                "description": "Enable or disable the createion of Application Insights."
+              }
+            },
+            "enableDaprInstrumentation": {
+              "type": "bool",
+              "metadata": {
+                "description": "Enable or disable Dapr application instrumentation using Application Insights. If enableApplicationInsights is false, this parameter is ignored."
+              }
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource id of an existing Azure Log Analytics Workspace."
+              }
+            },
+            "deployZoneRedundantResources": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false."
+              }
+            },
+            "containerRegistryUserAssignedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the user-assigned managed identity for the Azure Container Registry to be able to pull images from it."
+              }
+            }
+          },
+          "variables": {
+            "workProfileName": "general-purpose",
+            "virtualNetworkLinks": "[concat(createArray(createObject('virtualNetworkResourceId', resourceId('Microsoft.Network/virtualNetworks', parameters('spokeVNetName')), 'registrationEnabled', false())), if(not(empty(parameters('hubVNetId'))), createArray(createObject('virtualNetworkResourceId', parameters('hubVNetId'), 'registrationEnabled', false())), createArray()))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('acaNamingDeployment-{0}', deployment().name), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "uniqueId": {
+                    "value": "[uniqueString(resourceGroup().id)]"
+                  },
+                  "environment": {
+                    "value": "[parameters('environment')]"
+                  },
+                  "workloadName": {
+                    "value": "[parameters('workloadName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "4794676376542080363"
+                    }
+                  },
+                  "parameters": {
+                    "workloadName": {
+                      "type": "string",
+                      "minLength": 2,
+                      "maxLength": 10,
+                      "metadata": {
+                        "description": "The name of the workloard that is being deployed. Up to 10 characters long."
+                      }
+                    },
+                    "environment": {
+                      "type": "string",
+                      "maxLength": 8,
+                      "metadata": {
+                        "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\") Up to 8 characters long."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location for all Resources."
+                      }
+                    },
+                    "uniqueId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness"
+                      }
+                    }
+                  },
+                  "variables": {
+                    "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+                    "naming": "[json(variables('$fxv#0'))]",
+                    "uniqueIdShort": "[substring(parameters('uniqueId'), 0, 5)]",
+                    "resourceTypeToken": "RES_TYPE",
+                    "namingBase": "[format('{0}-{1}-{2}-{3}', variables('resourceTypeToken'), parameters('workloadName'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseUnique": "[format('{0}-{1}-{2}-{3}-{4}', variables('resourceTypeToken'), parameters('workloadName'), variables('uniqueIdShort'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseNoWorkloadName": "[format('{0}-{1}-{2}', variables('resourceTypeToken'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "resourceTypeAbbreviations": "[variables('naming').resourceTypeAbbreviations]",
+                    "keyVaultName": "[take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault), 24)]",
+                    "resourceNames": {
+                      "vnetSpoke": "[format('{0}-spoke', replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "vnetHub": "[format('{0}-hub', replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "applicationGateway": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway)]",
+                      "applicationGatewayPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayUserAssignedIdentity": "[format('{0}-{1}-KeyVaultSecretUser', variables('naming').resourceTypeAbbreviations.managedIdentity, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "pepNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.privateEndpoint))]",
+                      "applicationInsights": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationInsights)]",
+                      "azureFirewall": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall)]",
+                      "azureFirewallPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall))]",
+                      "bastion": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion)]",
+                      "bastionNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "bastionPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "containerAppsEnvironment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment)]",
+                      "containerAppsEnvironmentNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment))]",
+                      "containerRegistry": "[take(toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')), 50)]",
+                      "containerRegistryPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "containerRegistryUserAssignedIdentity": "[format('{0}-{1}-AcrPull', variables('naming').resourceTypeAbbreviations.managedIdentity, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "redisCache": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache)]",
+                      "redisCachePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache))]",
+                      "openAiAccount": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cognitiveAccount)]",
+                      "openAiDeployment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.openAiDeployment)]",
+                      "cosmosDbNoSql": "[toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44))]",
+                      "cosmosDbNoSqlPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44)))]",
+                      "frontDoorProfile": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "keyVault": "[if(endsWith(variables('keyVaultName'), '-'), take(variables('keyVaultName'), 23), variables('keyVaultName'))]",
+                      "keyVaultPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault))]",
+                      "logAnalyticsWorkspace": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.logAnalyticsWorkspace)]",
+                      "routeTable": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.routeTable)]",
+                      "serviceBus": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus)]",
+                      "serviceBusPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus))]",
+                      "storageAccount": "[toLower(take(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount), '-', ''), 24))]",
+                      "storageAccountPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount)))]",
+                      "vmJumpBox": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine)]",
+                      "vmJumpBoxNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "vmJumpBoxNic": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkInterface, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "frontDoor": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "azureAISearch": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch)]",
+                      "azureAISearchPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch))]",
+                      "documentIntelligence": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence)]",
+                      "documentIntelligencePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence))]",
+                      "eventGridSystemTopic": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic)]",
+                      "eventGridSystemTopicPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic))]",
+                      "eventGridSubscription": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSubscription)]"
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourcesNames": {
+                      "type": "object",
+                      "value": "[variables('resourceNames')]"
+                    },
+                    "resourceTypeAbbreviations": {
+                      "type": "object",
+                      "value": "[variables('resourceTypeAbbreviations')]"
+                    }
+                  }
+                }
+              },
+              "metadata": {
+                "description": "User-configured naming rules"
+              }
+            },
+            {
+              "condition": "[parameters('enableApplicationInsights')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('applicationInsights-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('acaNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationInsights]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "workspaceResourceId": {
+                    "value": "[parameters('logAnalyticsWorkspaceId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15992072010754675807"
+                    },
+                    "name": "Application Insights",
+                    "description": "This component deploys an Application Insights instance.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Application Insights."
+                      }
+                    },
+                    "applicationType": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "allowedValues": [
+                        "web",
+                        "other"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Application type."
+                      }
+                    },
+                    "workspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
+                      }
+                    },
+                    "disableIpMasking": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Disable IP masking. Default value is set to true."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
+                      }
+                    },
+                    "forceCustomerStorageForProfiler": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Force users to create their own storage account for profiler and debugger."
+                      }
+                    },
+                    "linkedStorageAccountResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Linked storage account resource ID."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "allowedValues": [
+                        30,
+                        60,
+                        90,
+                        120,
+                        180,
+                        270,
+                        365,
+                        550,
+                        730
+                      ],
+                      "metadata": {
+                        "description": "Optional. Retention period in days."
+                      }
+                    },
+                    "samplingPercentage": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "minValue": 0,
+                      "maxValue": 100,
+                      "metadata": {
+                        "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "appInsights": {
+                      "type": "Microsoft.Insights/components",
+                      "apiVersion": "2020-02-02",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "properties": {
+                        "Application_Type": "[parameters('applicationType')]",
+                        "DisableIpMasking": "[parameters('disableIpMasking')]",
+                        "DisableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
+                        "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                        "RetentionInDays": "[parameters('retentionInDays')]",
+                        "SamplingPercentage": "[parameters('samplingPercentage')]"
+                      }
+                    },
+                    "appInsights_roleAssignments": {
+                      "copy": {
+                        "name": "appInsights_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "appInsights_diagnosticSettings": {
+                      "copy": {
+                        "name": "appInsights_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "linkedStorageAccount": {
+                      "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appInsightsName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[parameters('linkedStorageAccountResourceId')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "11213930862679606021"
+                            },
+                            "name": "Application Insights Linked Storage Account",
+                            "description": "This component deploys an Application Insights Linked Storage Account.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "appInsightsName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Linked storage account resource ID."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "microsoft.insights/components/linkedStorageAccounts",
+                              "apiVersion": "2020-03-01-preview",
+                              "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
+                              "properties": {
+                                "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Linked Storage Account."
+                              },
+                              "value": "ServiceProfiler"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Linked Storage Account."
+                              },
+                              "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the agent pool was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the application insights component."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the application insights component."
+                      },
+                      "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the application insights component was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "applicationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The application ID of the application insights component."
+                      },
+                      "value": "[reference('appInsights').AppId]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('appInsights', '2020-02-02', 'full').location]"
+                    },
+                    "instrumentationKey": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+                      },
+                      "value": "[reference('appInsights').InstrumentationKey]"
+                    },
+                    "connectionString": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application Insights Connection String."
+                      },
+                      "value": "[reference('appInsights').ConnectionString]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('acaNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "Azure Application Insights, the workload' log & metric sink and APM tool"
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('acaenv-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "logAnalyticsWorkspaceResourceId": {
+                    "value": "[parameters('logAnalyticsWorkspaceId')]"
+                  },
+                  "name": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('acaNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.containerAppsEnvironment]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "internal": {
+                    "value": true
+                  },
+                  "managedIdentities": {
+                    "value": {
+                      "userAssignedResourceIds": [
+                        "[parameters('containerRegistryUserAssignedIdentityId')]"
+                      ]
+                    }
+                  },
+                  "daprAIInstrumentationKey": "[if(and(parameters('enableDaprInstrumentation'), parameters('enableApplicationInsights')), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('applicationInsights-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.instrumentationKey.value), createObject('value', null()))]",
+                  "infrastructureSubnetId": {
+                    "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('spokeVNetName'), parameters('spokeInfraSubnetName'))]"
+                  },
+                  "workloadProfiles": {
+                    "value": [
+                      {
+                        "maximumCount": 3,
+                        "minimumCount": 0,
+                        "name": "[variables('workProfileName')]",
+                        "workloadProfileType": "D4"
+                      }
+                    ]
+                  },
+                  "zoneRedundant": {
+                    "value": "[parameters('deployZoneRedundantResources')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "13001855178530816021"
+                    },
+                    "name": "App ManagedEnvironments",
+                    "description": "This module deploys an App Managed Environment (also known as a Container App Environment).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "managedIdentitiesType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container Apps Managed Environment."
+                      }
+                    },
+                    "logAnalyticsWorkspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990)."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentitiesType",
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "logsDestination": {
+                      "type": "string",
+                      "defaultValue": "log-analytics",
+                      "metadata": {
+                        "description": "Optional. Logs destination."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "daprAIConnectionString": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
+                      }
+                    },
+                    "daprAIInstrumentationKey": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
+                      }
+                    },
+                    "dockerBridgeCidr": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "infrastructureSubnetId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "internal": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "platformReservedCidr": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
+                      }
+                    },
+                    "platformReservedDnsIP": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether or not this Managed Environment is zone-redundant."
+                      }
+                    },
+                    "certificatePassword": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Password of the certificate used by the custom domain."
+                      }
+                    },
+                    "certificateValue": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
+                      }
+                    },
+                    "dnsSuffix": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. DNS suffix for the environment domain."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "workloadProfiles": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "infrastructureResourceGroupName": {
+                      "type": "string",
+                      "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
+                      "metadata": {
+                        "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "logAnalyticsWorkspace": {
+                      "condition": "[not(empty(parameters('logAnalyticsWorkspaceResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2021-06-01",
+                      "subscriptionId": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]]",
+                      "name": "[last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))]"
+                    },
+                    "managedEnvironment": {
+                      "type": "Microsoft.App/managedEnvironments",
+                      "apiVersion": "2023-11-02-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "appLogsConfiguration": {
+                          "destination": "[parameters('logsDestination')]",
+                          "logAnalyticsConfiguration": {
+                            "customerId": "[reference('logAnalyticsWorkspace').customerId]",
+                            "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))), '2021-06-01').primarySharedKey]"
+                          }
+                        },
+                        "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
+                        "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
+                        "customDomainConfiguration": {
+                          "certificatePassword": "[parameters('certificatePassword')]",
+                          "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
+                          "dnsSuffix": "[parameters('dnsSuffix')]"
+                        },
+                        "vnetConfiguration": {
+                          "internal": "[parameters('internal')]",
+                          "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('infrastructureSubnetId'), null())]",
+                          "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('dockerBridgeCidr'), null())]",
+                          "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedCidr'), null())]",
+                          "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedDnsIP'), null())]"
+                        },
+                        "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
+                        "zoneRedundant": "[parameters('zoneRedundant')]",
+                        "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "managedEnvironment_roleAssignments": {
+                      "copy": {
+                        "name": "managedEnvironment_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "managedEnvironment_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Managed Environment was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('managedEnvironment', '2023-11-02-preview', 'full').location]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Managed Environment."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Managed Environment."
+                      },
+                      "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('managedEnvironment', '2023-11-02-preview', 'full'), 'identity'), 'principalId'), '')]"
+                    },
+                    "defaultDomain": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Default domain of the Managed Environment."
+                      },
+                      "value": "[reference('managedEnvironment').defaultDomain]"
+                    },
+                    "staticIp": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The IP address of the Managed Environment."
+                      },
+                      "value": "[reference('managedEnvironment').staticIp]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('applicationInsights-{0}', uniqueString(resourceGroup().id)), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('acaNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "The Azure Container Apps (ACA) cluster."
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('acaDnsZoneDeployment-{0}', uniqueString(resourceGroup().id))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('acaenv-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.defaultDomain.value]"
+                  },
+                  "location": {
+                    "value": "global"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "virtualNetworkLinks": {
+                    "value": "[variables('virtualNetworkLinks')]"
+                  },
+                  "a": {
+                    "value": [
+                      {
+                        "name": "*",
+                        "aRecords": [
+                          {
+                            "ipv4Address": "[reference(resourceId('Microsoft.Resources/deployments', take(format('acaenv-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.staticIp.value]"
+                          }
+                        ]
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "11412633288570781407"
+                    },
+                    "name": "Private DNS Zones",
+                    "description": "This module deploys a Private DNS zone.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "aType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "aRecords": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "ipv4Address": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IPv4 address of this A record."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The list of A records in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "aaaaType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "aaaaRecords": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "ipv6Address": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IPv6 address of this AAAA record."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The list of AAAA records in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "cnameType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "cnameRecord": {
+                            "type": "object",
+                            "properties": {
+                              "cname": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The canonical name of the CNAME record."
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The CNAME record in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "mxType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "mxRecords": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "exchange": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name of the mail host for this MX record."
+                                  }
+                                },
+                                "preference": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The preference value for this MX record."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The list of MX records in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "ptrType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "ptrRecords": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "ptrdname": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The PTR target domain name for this PTR record."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The list of PTR records in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "soaType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "soaRecord": {
+                            "type": "object",
+                            "properties": {
+                              "email": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The email contact for this SOA record."
+                                }
+                              },
+                              "expireTime": {
+                                "type": "int",
+                                "metadata": {
+                                  "description": "Required. The expire time for this SOA record."
+                                }
+                              },
+                              "host": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The domain name of the authoritative name server for this SOA record."
+                                }
+                              },
+                              "minimumTtl": {
+                                "type": "int",
+                                "metadata": {
+                                  "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                                }
+                              },
+                              "refreshTime": {
+                                "type": "int",
+                                "metadata": {
+                                  "description": "Required. The refresh value for this SOA record."
+                                }
+                              },
+                              "retryTime": {
+                                "type": "int",
+                                "metadata": {
+                                  "description": "Required. The retry time for this SOA record."
+                                }
+                              },
+                              "serialNumber": {
+                                "type": "int",
+                                "metadata": {
+                                  "description": "Required. The serial number for this SOA record."
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The SOA record in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "srvType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "srvRecords": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "priority": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The priority value for this SRV record."
+                                  }
+                                },
+                                "weight": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The weight value for this SRV record."
+                                  }
+                                },
+                                "port": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The port value for this SRV record."
+                                  }
+                                },
+                                "target": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The target domain name for this SRV record."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The list of SRV records in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "txtType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the record."
+                            }
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata of the record."
+                            }
+                          },
+                          "ttl": {
+                            "type": "int",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The TTL of the record."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "txtRecords": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "value": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The text value of this TXT record."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The list of TXT records in the record set."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Private DNS zone name."
+                      }
+                    },
+                    "a": {
+                      "$ref": "#/definitions/aType",
+                      "metadata": {
+                        "description": "Optional. Array of A records."
+                      }
+                    },
+                    "aaaa": {
+                      "$ref": "#/definitions/aaaaType",
+                      "metadata": {
+                        "description": "Optional. Array of AAAA records."
+                      }
+                    },
+                    "cname": {
+                      "$ref": "#/definitions/cnameType",
+                      "metadata": {
+                        "description": "Optional. Array of CNAME records."
+                      }
+                    },
+                    "mx": {
+                      "$ref": "#/definitions/mxType",
+                      "metadata": {
+                        "description": "Optional. Array of MX records."
+                      }
+                    },
+                    "ptr": {
+                      "$ref": "#/definitions/ptrType",
+                      "metadata": {
+                        "description": "Optional. Array of PTR records."
+                      }
+                    },
+                    "soa": {
+                      "$ref": "#/definitions/soaType",
+                      "metadata": {
+                        "description": "Optional. Array of SOA records."
+                      }
+                    },
+                    "srv": {
+                      "$ref": "#/definitions/srvType",
+                      "metadata": {
+                        "description": "Optional. Array of SRV records."
+                      }
+                    },
+                    "txt": {
+                      "$ref": "#/definitions/txtType",
+                      "metadata": {
+                        "description": "Optional. Array of TXT records."
+                      }
+                    },
+                    "virtualNetworkLinks": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "global",
+                      "metadata": {
+                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateDnsZone": {
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]"
+                    },
+                    "privateDnsZone_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_roleAssignments": {
+                      "copy": {
+                        "name": "privateDnsZone_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_A": {
+                      "copy": {
+                        "name": "privateDnsZone_A",
+                        "count": "[length(coalesce(parameters('a'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                          },
+                          "aRecords": {
+                            "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "8657463061873174631"
+                            },
+                            "name": "Private DNS Zone A record",
+                            "description": "This module deploys a Private DNS Zone A record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the A record."
+                              }
+                            },
+                            "aRecords": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of A records in the record set."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "A": {
+                              "type": "Microsoft.Network/privateDnsZones/A",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "aRecords": "[parameters('aRecords')]",
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "A_roleAssignments": {
+                              "copy": {
+                                "name": "A_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "A"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed A record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed A record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed A record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_AAAA": {
+                      "copy": {
+                        "name": "privateDnsZone_AAAA",
+                        "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                          },
+                          "aaaaRecords": {
+                            "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "1725749611610769138"
+                            },
+                            "name": "Private DNS Zone AAAA record",
+                            "description": "This module deploys a Private DNS Zone AAAA record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the AAAA record."
+                              }
+                            },
+                            "aaaaRecords": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of AAAA records in the record set."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "AAAA": {
+                              "type": "Microsoft.Network/privateDnsZones/AAAA",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "aaaaRecords": "[parameters('aaaaRecords')]",
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "AAAA_roleAssignments": {
+                              "copy": {
+                                "name": "AAAA_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "AAAA"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed AAAA record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed AAAA record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed AAAA record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_CNAME": {
+                      "copy": {
+                        "name": "privateDnsZone_CNAME",
+                        "count": "[length(coalesce(parameters('cname'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                          },
+                          "cnameRecord": {
+                            "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "12750497126800708872"
+                            },
+                            "name": "Private DNS Zone CNAME record",
+                            "description": "This module deploys a Private DNS Zone CNAME record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the CNAME record."
+                              }
+                            },
+                            "cnameRecord": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A CNAME record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "CNAME": {
+                              "type": "Microsoft.Network/privateDnsZones/CNAME",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "cnameRecord": "[parameters('cnameRecord')]",
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "CNAME_roleAssignments": {
+                              "copy": {
+                                "name": "CNAME_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "CNAME"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed CNAME record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed CNAME record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed CNAME record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_MX": {
+                      "copy": {
+                        "name": "privateDnsZone_MX",
+                        "count": "[length(coalesce(parameters('mx'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "mxRecords": {
+                            "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "13512848802819943036"
+                            },
+                            "name": "Private DNS Zone MX record",
+                            "description": "This module deploys a Private DNS Zone MX record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the MX record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "mxRecords": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of MX records in the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "MX": {
+                              "type": "Microsoft.Network/privateDnsZones/MX",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "mxRecords": "[parameters('mxRecords')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "MX_roleAssignments": {
+                              "copy": {
+                                "name": "MX_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "MX"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed MX record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed MX record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed MX record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_PTR": {
+                      "copy": {
+                        "name": "privateDnsZone_PTR",
+                        "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ptrRecords": {
+                            "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "5069219418696231980"
+                            },
+                            "name": "Private DNS Zone PTR record",
+                            "description": "This module deploys a Private DNS Zone PTR record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the PTR record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "ptrRecords": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of PTR records in the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "PTR": {
+                              "type": "Microsoft.Network/privateDnsZones/PTR",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "ptrRecords": "[parameters('ptrRecords')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "PTR_roleAssignments": {
+                              "copy": {
+                                "name": "PTR_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "PTR"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed PTR record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed PTR record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed PTR record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_SOA": {
+                      "copy": {
+                        "name": "privateDnsZone_SOA",
+                        "count": "[length(coalesce(parameters('soa'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "soaRecord": {
+                            "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "8649693365938652763"
+                            },
+                            "name": "Private DNS Zone SOA record",
+                            "description": "This module deploys a Private DNS Zone SOA record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the SOA record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "soaRecord": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A SOA record."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "SOA": {
+                              "type": "Microsoft.Network/privateDnsZones/SOA",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "soaRecord": "[parameters('soaRecord')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "SOA_roleAssignments": {
+                              "copy": {
+                                "name": "SOA_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "SOA"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed SOA record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed SOA record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed SOA record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_SRV": {
+                      "copy": {
+                        "name": "privateDnsZone_SRV",
+                        "count": "[length(coalesce(parameters('srv'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "srvRecords": {
+                            "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "1580431299497536987"
+                            },
+                            "name": "Private DNS Zone SRV record",
+                            "description": "This module deploys a Private DNS Zone SRV record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the SRV record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "srvRecords": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of SRV records in the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "SRV": {
+                              "type": "Microsoft.Network/privateDnsZones/SRV",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "srvRecords": "[parameters('srvRecords')]",
+                                "ttl": "[parameters('ttl')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "SRV_roleAssignments": {
+                              "copy": {
+                                "name": "SRV_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "SRV"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed SRV record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed SRV record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed SRV record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_TXT": {
+                      "copy": {
+                        "name": "privateDnsZone_TXT",
+                        "count": "[length(coalesce(parameters('txt'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "txtRecords": {
+                            "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "1628766837655887758"
+                            },
+                            "name": "Private DNS Zone TXT record",
+                            "description": "This module deploys a Private DNS Zone TXT record.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the TXT record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The metadata attached to the record set."
+                              }
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "txtRecords": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of TXT records in the record set."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "TXT": {
+                              "type": "Microsoft.Network/privateDnsZones/TXT",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]",
+                                "txtRecords": "[parameters('txtRecords')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "TXT_roleAssignments": {
+                              "copy": {
+                                "name": "TXT_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "TXT"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed TXT record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed TXT record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed TXT record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_virtualNetworkLinks": {
+                      "copy": {
+                        "name": "privateDnsZone_virtualNetworkLinks",
+                        "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                          },
+                          "virtualNetworkResourceId": {
+                            "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                          },
+                          "registrationEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "8423159394395901832"
+                            },
+                            "name": "Private DNS Zone Virtual Network Link",
+                            "description": "This module deploys a Private DNS Zone Virtual Network Link.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The name of the virtual network link."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "global",
+                              "metadata": {
+                                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "registrationEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                              }
+                            },
+                            "virtualNetworkResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Link to another virtual network resource ID."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "virtualNetworkLink": {
+                              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "registrationEnabled": "[parameters('registrationEnabled')]",
+                                "virtualNetwork": {
+                                  "id": "[parameters('virtualNetworkResourceId')]"
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed virtual network link."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed virtual network link."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed virtual network link."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('virtualNetworkLink', '2020-06-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private DNS zone was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private DNS zone."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private DNS zone."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('acaenv-{0}', uniqueString(resourceGroup().id)), 64))]"
+              ],
+              "metadata": {
+                "description": "The Private DNS zone containing the ACA load balancer IP"
+              }
+            }
+          ],
+          "outputs": {
+            "containerAppsEnvironmentId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Container Apps environment."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('acaenv-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.resourceId.value]"
+            },
+            "containerAppsEnvironmentName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Container Apps environment."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('acaenv-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.name.value]"
+            },
+            "applicationInsightsName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Application Insights instance."
+              },
+              "value": "[if(parameters('enableApplicationInsights'), reference(resourceId('Microsoft.Resources/deployments', take(format('applicationInsights-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.name.value, '')]"
+            },
+            "workloadProfileNames": {
+              "type": "array",
+              "metadata": {
+                "description": "The name of the workload profiles provisioned in the Container Apps environment."
+              },
+              "value": [
+                "[variables('workProfileName')]"
+              ]
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64))]"
+      ]
+    },
+    {
+      "condition": "[parameters('deploySampleApplication')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('sampleApplication-{0}-deployment', deployment().name), 64)]",
+      "resourceGroup": "[variables('rgSpokeName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "containerAppsEnvironmentId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerAppsEnvironmentId.value]"
+          },
+          "workloadProfileName": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.workloadProfileNames.value[0]]"
+          },
+          "containerRegistryUserAssignedIdentityId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerRegistryUserAssignedIdentityId.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "16668830347449265665"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "The location where the resources will be created. This needs to be the same region as the Azure Container Apps instances."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The tags to be assigned to the created resources."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Whether to enable deplotment telemetry."
+              }
+            },
+            "helloWorldContainerAppName": {
+              "type": "string",
+              "defaultValue": "ca-simple-hello",
+              "minLength": 2,
+              "maxLength": 32,
+              "metadata": {
+                "description": "Optional. The name of the Container App. If set, it overrides the name generated by the template."
+              }
+            },
+            "containerRegistryUserAssignedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing user-assigned managed identity to be assigned to the Container App to be able to pull images from the container registry."
+              }
+            },
+            "containerAppsEnvironmentId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing Container Apps environment in which the Container App will be deployed."
+              }
+            },
+            "workloadProfileName": {
+              "type": "string",
+              "metadata": {
+                "description": "The container apps environment workload profile to use for the Container App."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[parameters('helloWorldContainerAppName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('helloWorldContainerAppName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "environmentId": {
+                    "value": "[parameters('containerAppsEnvironmentId')]"
+                  },
+                  "managedIdentities": {
+                    "value": {
+                      "userAssignedResourceIds": [
+                        "[parameters('containerRegistryUserAssignedIdentityId')]"
+                      ]
+                    }
+                  },
+                  "workloadProfileName": {
+                    "value": "[parameters('workloadProfileName')]"
+                  },
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "simple-hello",
+                        "image": "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest",
+                        "resources": {
+                          "cpu": "[json('0.25')]",
+                          "memory": "0.5Gi"
+                        }
+                      }
+                    ]
+                  },
+                  "scaleMinReplicas": {
+                    "value": 2
+                  },
+                  "scaleMaxReplicas": {
+                    "value": 10
+                  },
+                  "activeRevisionsMode": {
+                    "value": "Single"
+                  },
+                  "ingressExternal": {
+                    "value": true
+                  },
+                  "ingressAllowInsecure": {
+                    "value": false
+                  },
+                  "ingressTargetPort": {
+                    "value": 80
+                  },
+                  "ingressTransport": {
+                    "value": "auto"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.27.1.19265",
+                      "templateHash": "6251669835322227304"
+                    },
+                    "name": "Container Apps",
+                    "description": "This module deploys a Container App.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "managedIdentitiesType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "container": {
+                      "type": "object",
+                      "properties": {
+                        "args": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Container start command arguments."
+                          }
+                        },
+                        "command": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Container start command."
+                          }
+                        },
+                        "env": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/environmentVar"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Container environment variables."
+                          }
+                        },
+                        "image": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Container image tag."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom container name."
+                          }
+                        },
+                        "probes": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerAppProbe"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of probes for the container."
+                          }
+                        },
+                        "resources": {
+                          "type": "object",
+                          "metadata": {
+                            "description": "Required. Container resource requirements."
+                          }
+                        },
+                        "volumeMounts": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/volumeMount"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Container volume mounts."
+                          }
+                        }
+                      }
+                    },
+                    "environmentVar": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Environment variable name."
+                          }
+                        },
+                        "secretRef": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Non-secret environment variable value."
+                          }
+                        }
+                      }
+                    },
+                    "containerAppProbe": {
+                      "type": "object",
+                      "properties": {
+                        "failureThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
+                          }
+                        },
+                        "httpGet": {
+                          "$ref": "#/definitions/containerAppProbeHttpGet",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTPGet specifies the http request to perform."
+                          }
+                        },
+                        "initialDelaySeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 60,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
+                          }
+                        },
+                        "periodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
+                          }
+                        },
+                        "successThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
+                          }
+                        },
+                        "tcpSocket": {
+                          "$ref": "#/definitions/containerAppProbeTcpSocket",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported."
+                          }
+                        },
+                        "terminationGracePeriodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
+                          }
+                        },
+                        "timeoutSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Liveness",
+                            "Readiness",
+                            "Startup"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The type of probe."
+                          }
+                        }
+                      }
+                    },
+                    "containerAppProbeHttpGet": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
+                          }
+                        },
+                        "httpHeaders": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItem"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTP headers to set in the request."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path to access on the HTTP server."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Name or number of the port to access on the container."
+                          }
+                        },
+                        "scheme": {
+                          "type": "string",
+                          "allowedValues": [
+                            "HTTP",
+                            "HTTPS"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
+                          }
+                        }
+                      }
+                    },
+                    "containerAppProbeHttpGetHeadersItem": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the header."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Value of the header."
+                          }
+                        }
+                      }
+                    },
+                    "containerAppProbeTcpSocket": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to, defaults to the pod IP."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "minValue": 1,
+                          "maxValue": 65535,
+                          "metadata": {
+                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
+                          }
+                        }
+                      }
+                    },
+                    "volumeMount": {
+                      "type": "object",
+                      "properties": {
+                        "mountPath": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
+                          }
+                        },
+                        "subPath": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
+                          }
+                        },
+                        "volumeName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. This must match the Name of a Volume."
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container App."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "ingressExternal": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
+                      }
+                    },
+                    "stickySessionsAffinity": {
+                      "type": "string",
+                      "defaultValue": "none",
+                      "allowedValues": [
+                        "none",
+                        "sticky"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
+                      }
+                    },
+                    "ingressTransport": {
+                      "type": "string",
+                      "defaultValue": "auto",
+                      "allowedValues": [
+                        "auto",
+                        "http",
+                        "http2",
+                        "tcp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ingress transport protocol."
+                      }
+                    },
+                    "ingressAllowInsecure": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
+                      }
+                    },
+                    "ingressTargetPort": {
+                      "type": "int",
+                      "defaultValue": 80,
+                      "metadata": {
+                        "description": "Optional. Target Port in containers for traffic from ingress."
+                      }
+                    },
+                    "scaleMaxReplicas": {
+                      "type": "int",
+                      "defaultValue": 10,
+                      "metadata": {
+                        "description": "Optional. Maximum number of container replicas. Defaults to 10 if not set."
+                      }
+                    },
+                    "scaleMinReplicas": {
+                      "type": "int",
+                      "defaultValue": 3,
+                      "metadata": {
+                        "description": "Optional. Minimum number of container replicas. Defaults to 3 if not set."
+                      }
+                    },
+                    "scaleRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Scaling rules."
+                      }
+                    },
+                    "activeRevisionsMode": {
+                      "type": "string",
+                      "defaultValue": "Single",
+                      "allowedValues": [
+                        "Multiple",
+                        "Single"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Controls how active revisions are handled for the Container app."
+                      }
+                    },
+                    "environmentId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of environment."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "registries": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentitiesType",
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "customDomains": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Custom domain bindings for Container App hostnames."
+                      }
+                    },
+                    "exposedPort": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
+                      }
+                    },
+                    "ipSecurityRestrictions": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Rules to restrict incoming IP address."
+                      }
+                    },
+                    "trafficLabel": {
+                      "type": "string",
+                      "defaultValue": "label-1",
+                      "metadata": {
+                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
+                      }
+                    },
+                    "trafficLatestRevision": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
+                      }
+                    },
+                    "trafficRevisionName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Name of a revision."
+                      }
+                    },
+                    "trafficWeight": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "metadata": {
+                        "description": "Optional. Traffic weight assigned to a revision."
+                      }
+                    },
+                    "dapr": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Dapr configuration for the Container App."
+                      }
+                    },
+                    "maxInactiveRevisions": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Max inactive revisions a Container App can have."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/container"
+                      },
+                      "metadata": {
+                        "description": "Required. List of container definitions for the Container App."
+                      }
+                    },
+                    "initContainersTemplate": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. List of specialized containers that run before app containers."
+                      }
+                    },
+                    "secrets": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The secrets of the Container App."
+                      }
+                    },
+                    "revisionSuffix": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. User friendly suffix that is appended to the revision name."
+                      }
+                    },
+                    "volumes": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. List of volume definitions for the Container App."
+                      }
+                    },
+                    "workloadProfileName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Workload profile name to pin for container app execution."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "secretList": "[if(not(empty(parameters('secrets'))), parameters('secrets').secureList, createArray())]",
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "containerApp": {
+                      "type": "Microsoft.App/containerApps",
+                      "apiVersion": "2023-05-01",
+                      "name": "[parameters('name')]",
+                      "tags": "[parameters('tags')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "environmentId": "[parameters('environmentId')]",
+                        "configuration": {
+                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
+                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
+                          "ingress": {
+                            "allowInsecure": "[parameters('ingressAllowInsecure')]",
+                            "customDomains": "[if(not(empty(parameters('customDomains'))), parameters('customDomains'), null())]",
+                            "exposedPort": "[parameters('exposedPort')]",
+                            "external": "[parameters('ingressExternal')]",
+                            "ipSecurityRestrictions": "[if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null())]",
+                            "targetPort": "[parameters('ingressTargetPort')]",
+                            "stickySessions": {
+                              "affinity": "[parameters('stickySessionsAffinity')]"
+                            },
+                            "traffic": [
+                              {
+                                "label": "[parameters('trafficLabel')]",
+                                "latestRevision": "[parameters('trafficLatestRevision')]",
+                                "revisionName": "[parameters('trafficRevisionName')]",
+                                "weight": "[parameters('trafficWeight')]"
+                              }
+                            ],
+                            "transport": "[parameters('ingressTransport')]"
+                          },
+                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
+                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
+                          "secrets": "[variables('secretList')]"
+                        },
+                        "template": {
+                          "containers": "[parameters('containers')]",
+                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
+                          "revisionSuffix": "[parameters('revisionSuffix')]",
+                          "scale": {
+                            "maxReplicas": "[parameters('scaleMaxReplicas')]",
+                            "minReplicas": "[parameters('scaleMinReplicas')]",
+                            "rules": "[if(not(empty(parameters('scaleRules'))), parameters('scaleRules'), null())]"
+                          },
+                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
+                        },
+                        "workloadProfileName": "[parameters('workloadProfileName')]"
+                      }
+                    },
+                    "containerApp_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_roleAssignments": {
+                      "copy": {
+                        "name": "containerApp_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Container App."
+                      },
+                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
+                    },
+                    "fqdn": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The configuration of ingress fqdn."
+                      },
+                      "value": "[reference('containerApp').configuration.ingress.fqdn]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Container App was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Container App."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('containerApp', '2023-05-01', 'full'), 'identity'), 'principalId'), '')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('containerApp', '2023-05-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "helloWorldAppFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "The FQDN of the \"Hello World\" Container App."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', parameters('helloWorldContainerAppName')), '2022-09-01').outputs.fqdn.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64))]"
+      ]
+    },
+    {
+      "condition": "[equals(parameters('exposeContainerAppsWith'), 'applicationGateway')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('applicationGateway-{0}-deployment', deployment().name), 64)]",
+      "resourceGroup": "[variables('rgSpokeName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "environment": {
+            "value": "[parameters('environment')]"
+          },
+          "workloadName": {
+            "value": "[parameters('workloadName')]"
+          },
+          "applicationGatewayCertificateKeyName": {
+            "value": "[parameters('applicationGatewayCertificateKeyName')]"
+          },
+          "applicationGatewayFqdn": {
+            "value": "[parameters('applicationGatewayFqdn')]"
+          },
+          "applicationGatewayPrimaryBackendEndFqdn": "[if(parameters('deploySampleApplication'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('sampleApplication-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.helloWorldAppFqdn.value), createObject('value', ''))]",
+          "applicationGatewaySubnetId": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeApplicationGatewaySubnetId.value]"
+          },
+          "base64Certificate": {
+            "value": "[parameters('base64Certificate')]"
+          },
+          "keyVaultId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.keyVaultResourceId.value]"
+          },
+          "deployZoneRedundantResources": {
+            "value": "[parameters('deployZoneRedundantResources')]"
+          },
+          "enableDdosProtection": {
+            "value": "[parameters('enableDdosProtection')]"
+          },
+          "applicationGatewayLogAnalyticsId": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.logAnalyticsWorkspaceId.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "13769306330739717588"
+            }
+          },
+          "parameters": {
+            "workloadName": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 10,
+              "metadata": {
+                "description": "The name of the workload that is being deployed. Up to 10 characters long."
+              }
+            },
+            "environment": {
+              "type": "string",
+              "maxLength": 8,
+              "metadata": {
+                "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\"). Up to 8 characters long."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "The location where the resources will be created. This needs to be the same region as the spoke."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The tags to be assigned to the created resources."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Defines whether to enable telemetry for the modules deployment."
+              }
+            },
+            "applicationGatewayFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "The FQDN of the Application Gateawy. Must match the TLS certificate."
+              }
+            },
+            "applicationGatewaySubnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The existing subnet resource ID to use for Application Gateway."
+              }
+            },
+            "applicationGatewayPrimaryBackendEndFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "The FQDN of the primary backend endpoint."
+              }
+            },
+            "appGatewayBackendHealthProbePath": {
+              "type": "string",
+              "defaultValue": "/",
+              "metadata": {
+                "description": "The path to use for Application Gateway's backend health probe."
+              }
+            },
+            "base64Certificate": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "The base64 encoded certificate to use for Application Gateway certificate. If this is provided, the certificate will be added to the Key Vault."
+              }
+            },
+            "applicationGatewayCertificateKeyName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the certificate key to use for Application Gateway certificate."
+              }
+            },
+            "applicationGatewayLogAnalyticsId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "The resource ID of the exsiting Log Analytics workload for diagnostic settngs, or nothing if you don't need any."
+              }
+            },
+            "keyVaultId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the existing Key Vault which contains Application Gateway's cert."
+              }
+            },
+            "deployZoneRedundantResources": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false."
+              }
+            },
+            "enableDdosProtection": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. DDoS protection mode for the Public IP of the Application Gateway. See https://learn.microsoft.com/azure/ddos-protection/ddos-protection-sku-comparison#skus"
+              }
+            }
+          },
+          "variables": {
+            "keyVaultIdTokens": "[split(parameters('keyVaultId'), '/')]",
+            "keyVaultSubscriptionId": "[variables('keyVaultIdTokens')[2]]",
+            "keyVaultResourceGroupName": "[variables('keyVaultIdTokens')[4]]",
+            "keyVaultName": "[variables('keyVaultIdTokens')[8]]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('agwNamingDeployment-{0}', deployment().name), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "uniqueId": {
+                    "value": "[uniqueString(resourceGroup().id)]"
+                  },
+                  "environment": {
+                    "value": "[parameters('environment')]"
+                  },
+                  "workloadName": {
+                    "value": "[parameters('workloadName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "4794676376542080363"
+                    }
+                  },
+                  "parameters": {
+                    "workloadName": {
+                      "type": "string",
+                      "minLength": 2,
+                      "maxLength": 10,
+                      "metadata": {
+                        "description": "The name of the workloard that is being deployed. Up to 10 characters long."
+                      }
+                    },
+                    "environment": {
+                      "type": "string",
+                      "maxLength": 8,
+                      "metadata": {
+                        "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\") Up to 8 characters long."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location for all Resources."
+                      }
+                    },
+                    "uniqueId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness"
+                      }
+                    }
+                  },
+                  "variables": {
+                    "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+                    "naming": "[json(variables('$fxv#0'))]",
+                    "uniqueIdShort": "[substring(parameters('uniqueId'), 0, 5)]",
+                    "resourceTypeToken": "RES_TYPE",
+                    "namingBase": "[format('{0}-{1}-{2}-{3}', variables('resourceTypeToken'), parameters('workloadName'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseUnique": "[format('{0}-{1}-{2}-{3}-{4}', variables('resourceTypeToken'), parameters('workloadName'), variables('uniqueIdShort'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseNoWorkloadName": "[format('{0}-{1}-{2}', variables('resourceTypeToken'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "resourceTypeAbbreviations": "[variables('naming').resourceTypeAbbreviations]",
+                    "keyVaultName": "[take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault), 24)]",
+                    "resourceNames": {
+                      "vnetSpoke": "[format('{0}-spoke', replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "vnetHub": "[format('{0}-hub', replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "applicationGateway": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway)]",
+                      "applicationGatewayPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayUserAssignedIdentity": "[format('{0}-{1}-KeyVaultSecretUser', variables('naming').resourceTypeAbbreviations.managedIdentity, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "pepNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.privateEndpoint))]",
+                      "applicationInsights": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationInsights)]",
+                      "azureFirewall": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall)]",
+                      "azureFirewallPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall))]",
+                      "bastion": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion)]",
+                      "bastionNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "bastionPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "containerAppsEnvironment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment)]",
+                      "containerAppsEnvironmentNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment))]",
+                      "containerRegistry": "[take(toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')), 50)]",
+                      "containerRegistryPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "containerRegistryUserAssignedIdentity": "[format('{0}-{1}-AcrPull', variables('naming').resourceTypeAbbreviations.managedIdentity, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "redisCache": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache)]",
+                      "redisCachePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache))]",
+                      "openAiAccount": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cognitiveAccount)]",
+                      "openAiDeployment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.openAiDeployment)]",
+                      "cosmosDbNoSql": "[toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44))]",
+                      "cosmosDbNoSqlPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44)))]",
+                      "frontDoorProfile": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "keyVault": "[if(endsWith(variables('keyVaultName'), '-'), take(variables('keyVaultName'), 23), variables('keyVaultName'))]",
+                      "keyVaultPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault))]",
+                      "logAnalyticsWorkspace": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.logAnalyticsWorkspace)]",
+                      "routeTable": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.routeTable)]",
+                      "serviceBus": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus)]",
+                      "serviceBusPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus))]",
+                      "storageAccount": "[toLower(take(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount), '-', ''), 24))]",
+                      "storageAccountPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount)))]",
+                      "vmJumpBox": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine)]",
+                      "vmJumpBoxNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "vmJumpBoxNic": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkInterface, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "frontDoor": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "azureAISearch": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch)]",
+                      "azureAISearchPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch))]",
+                      "documentIntelligence": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence)]",
+                      "documentIntelligencePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence))]",
+                      "eventGridSystemTopic": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic)]",
+                      "eventGridSystemTopicPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic))]",
+                      "eventGridSubscription": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSubscription)]"
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourcesNames": {
+                      "type": "object",
+                      "value": "[variables('resourceNames')]"
+                    },
+                    "resourceTypeAbbreviations": {
+                      "type": "object",
+                      "value": "[variables('resourceTypeAbbreviations')]"
+                    }
+                  }
+                }
+              },
+              "metadata": {
+                "description": "User-configured naming rules"
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('appGwUserAssignedIdentity-Deployment-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGatewayUserAssignedIdentity]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.26.54.24096",
+                      "templateHash": "998408512764899332"
+                    },
+                    "name": "User Assigned Identities",
+                    "description": "This module deploys a User Assigned Identity.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "federatedIdentityCredentialsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the federated identity credential."
+                            }
+                          },
+                          "audiences": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. The list of audiences that can appear in the issued token."
+                            }
+                          },
+                          "issuer": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The URL of the issuer to be trusted."
+                            }
+                          },
+                          "subject": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The identifier of the external identity."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the User Assigned Identity."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "federatedIdentityCredentials": {
+                      "$ref": "#/definitions/federatedIdentityCredentialsType",
+                      "metadata": {
+                        "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]",
+                      "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.2.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "userAssignedIdentity": {
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2023-01-31",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]"
+                    },
+                    "userAssignedIdentity_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "userAssignedIdentity"
+                      ]
+                    },
+                    "userAssignedIdentity_roleAssignments": {
+                      "copy": {
+                        "name": "userAssignedIdentity_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "userAssignedIdentity"
+                      ]
+                    },
+                    "userAssignedIdentity_federatedIdentityCredentials": {
+                      "copy": {
+                        "name": "userAssignedIdentity_federatedIdentityCredentials",
+                        "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-UserMSI-FederatedIdentityCredential-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]"
+                          },
+                          "userAssignedIdentityName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "audiences": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]"
+                          },
+                          "issuer": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]"
+                          },
+                          "subject": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.26.54.24096",
+                              "templateHash": "4317497001099502136"
+                            },
+                            "name": "User Assigned Identity Federated Identity Credential",
+                            "description": "This module deploys a User Assigned Identity Federated Identity Credential.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "userAssignedIdentityName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the secret."
+                              }
+                            },
+                            "audiences": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
+                              }
+                            },
+                            "issuer": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
+                              }
+                            },
+                            "subject": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+                              "apiVersion": "2023-01-31",
+                              "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
+                              "properties": {
+                                "audiences": "[parameters('audiences')]",
+                                "issuer": "[parameters('issuer')]",
+                                "subject": "[parameters('subject')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the federated identity credential."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the federated identity credential."
+                              },
+                              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the federated identity credential was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "userAssignedIdentity"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the user assigned identity."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the user assigned identity."
+                      },
+                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
+                    },
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID (object ID) of the user assigned identity."
+                      },
+                      "value": "[reference('userAssignedIdentity').principalId]"
+                    },
+                    "clientId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The client ID (application ID) of the user assigned identity."
+                      },
+                      "value": "[reference('userAssignedIdentity').clientId]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the user assigned identity was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('userAssignedIdentity', '2023-01-31', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64))]"
+              ],
+              "metadata": {
+                "description": "A user-assigned managed identity that enables Application Gateway to access Key Vault for its TLS certs."
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('base64Certificate')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('appGatewayAddCertificates-Deployment-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "subscriptionId": "[variables('keyVaultSubscriptionId')]",
+              "resourceGroup": "[variables('keyVaultResourceGroupName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "keyVaultName": {
+                    "value": "[variables('keyVaultName')]"
+                  },
+                  "appGatewayCertificateData": {
+                    "value": "[parameters('base64Certificate')]"
+                  },
+                  "appGatewayCertificateKeyName": {
+                    "value": "[parameters('applicationGatewayCertificateKeyName')]"
+                  },
+                  "appGatewayUserAssignedIdentityPrincipalId": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('appGwUserAssignedIdentity-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.principalId.value]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "15933024016056946085"
+                    }
+                  },
+                  "parameters": {
+                    "keyVaultName": {
+                      "type": "string"
+                    },
+                    "appGatewayUserAssignedIdentityPrincipalId": {
+                      "type": "string"
+                    },
+                    "appGatewayCertificateKeyName": {
+                      "type": "string"
+                    },
+                    "appGatewayCertificateData": {
+                      "type": "string"
+                    }
+                  },
+                  "variables": {
+                    "keyVaultSecretUserRoleGuid": "4633458b-17de-408a-b874-0445c86b69e6"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.KeyVault/vaults/secrets",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('appGatewayCertificateKeyName'))]",
+                      "properties": {
+                        "value": "[parameters('appGatewayCertificateData')]",
+                        "contentType": "application/x-pkcs12",
+                        "attributes": {
+                          "enabled": true
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('appGatewayCertificateKeyName'))]",
+                      "name": "[guid(subscription().id, resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('appGatewayUserAssignedIdentityPrincipalId'), 'KeyVaultSecretUser')]",
+                      "properties": {
+                        "principalId": "[parameters('appGatewayUserAssignedIdentityPrincipalId')]",
+                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('keyVaultSecretUserRoleGuid'))]",
+                        "principalType": "ServicePrincipal"
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('appGatewayCertificateKeyName'))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "SecretUri": {
+                      "type": "string",
+                      "value": "[reference(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('appGatewayCertificateKeyName')), '2023-07-01').secretUri]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('appGwUserAssignedIdentity-Deployment-{0}', uniqueString(resourceGroup().id)), 64))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('applicationGatewayPublicIp-Deployment-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "name": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGatewayPip]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "skuName": {
+                    "value": "Standard"
+                  },
+                  "publicIPAllocationMethod": {
+                    "value": "Static"
+                  },
+                  "ddosSettings": "[if(parameters('enableDdosProtection'), createObject('value', createObject('protectionMode', 'Enabled')), createObject('value', null()))]",
+                  "zones": "[if(parameters('deployZoneRedundantResources'), createObject('value', createArray(1, 2, 3)), createObject('value', createArray()))]",
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "metricCategories": [
+                          {
+                            "category": "AllMetrics"
+                          }
+                        ],
+                        "name": "publicIpDiagnosticSettings",
+                        "workspaceResourceId": "[parameters('applicationGatewayLogAnalyticsId')]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.27.1.19265",
+                      "templateHash": "10356333973104369631"
+                    },
+                    "name": "Public IP Addresses",
+                    "description": "This module deploys a Public IP Address.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "dnsSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "domainNameLabel": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                          }
+                        },
+                        "domainNameLabelScope": {
+                          "type": "string",
+                          "allowedValues": [
+                            "",
+                            "NoReuse",
+                            "ResourceGroupReuse",
+                            "SubscriptionReuse",
+                            "TenantReuse"
+                          ],
+                          "metadata": {
+                            "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                          }
+                        },
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                          }
+                        },
+                        "reverseFqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                          }
+                        }
+                      }
+                    },
+                    "ddosSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "ddosProtectionPlan": {
+                          "type": "object",
+                          "properties": {
+                            "id": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DDoS protection plan associated with the public IP address."
+                          }
+                        },
+                        "protectionMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. The DDoS protection policy customizations."
+                          }
+                        }
+                      }
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Public IP Address."
+                      }
+                    },
+                    "publicIpPrefixResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                      }
+                    },
+                    "publicIPAllocationMethod": {
+                      "type": "string",
+                      "defaultValue": "Static",
+                      "allowedValues": [
+                        "Dynamic",
+                        "Static"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The public IP address allocation method."
+                      }
+                    },
+                    "zones": {
+                      "type": "array",
+                      "items": {
+                        "type": "int"
+                      },
+                      "defaultValue": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "allowedValues": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "metadata": {
+                        "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                      }
+                    },
+                    "publicIPAddressVersion": {
+                      "type": "string",
+                      "defaultValue": "IPv4",
+                      "allowedValues": [
+                        "IPv4",
+                        "IPv6"
+                      ],
+                      "metadata": {
+                        "description": "Optional. IP address version."
+                      }
+                    },
+                    "dnsSettings": {
+                      "$ref": "#/definitions/dnsSettingsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The DNS settings of the public IP address."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Basic",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Name of a public IP address SKU."
+                      }
+                    },
+                    "skuTier": {
+                      "type": "string",
+                      "defaultValue": "Regional",
+                      "allowedValues": [
+                        "Global",
+                        "Regional"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Tier of a public IP address SKU."
+                      }
+                    },
+                    "ddosSettings": {
+                      "$ref": "#/definitions/ddosSettingsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "idleTimeoutInMinutes": {
+                      "type": "int",
+                      "defaultValue": 4,
+                      "metadata": {
+                        "description": "Optional. The idle timeout of the public IP address."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "publicIpAddress": {
+                      "type": "Microsoft.Network/publicIPAddresses",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "tier": "[parameters('skuTier')]"
+                      },
+                      "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                      "properties": {
+                        "ddosSettings": "[parameters('ddosSettings')]",
+                        "dnsSettings": "[parameters('dnsSettings')]",
+                        "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                        "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                        "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                        "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                        "ipTags": null
+                      }
+                    },
+                    "publicIpAddress_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    },
+                    "publicIpAddress_roleAssignments": {
+                      "copy": {
+                        "name": "publicIpAddress_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    },
+                    "publicIpAddress_diagnosticSettings": {
+                      "copy": {
+                        "name": "publicIpAddress_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the public IP address was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the public IP address."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the public IP address."
+                      },
+                      "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                    },
+                    "ipAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The public IP address of the public IP address resource."
+                      },
+                      "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('applicationGateway-Deployment-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "backendAddressPools": {
+                    "value": [
+                      {
+                        "name": "acaServiceBackend",
+                        "properties": {
+                          "backendAddresses": "[if(not(empty(parameters('applicationGatewayPrimaryBackendEndFqdn'))), createArray(createObject('fqdn', parameters('applicationGatewayPrimaryBackendEndFqdn'))), null())]"
+                        }
+                      }
+                    ]
+                  },
+                  "backendHttpSettingsCollection": {
+                    "value": [
+                      {
+                        "name": "https",
+                        "properties": {
+                          "port": 443,
+                          "protocol": "Https",
+                          "cookieBasedAffinity": "Disabled",
+                          "pickHostNameFromBackendAddress": true,
+                          "requestTimeout": 20,
+                          "probe": "[if(not(empty(parameters('applicationGatewayPrimaryBackendEndFqdn'))), createObject('id', resourceId('Microsoft.Network/applicationGateways/probes', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway, 'webProbe')), null())]"
+                        }
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "metricCategories": [
+                          {
+                            "category": "AllMetrics"
+                          }
+                        ],
+                        "name": "customSetting",
+                        "workspaceResourceId": "[parameters('applicationGatewayLogAnalyticsId')]"
+                      }
+                    ]
+                  },
+                  "enableHttp2": {
+                    "value": true
+                  },
+                  "frontendIPConfigurations": {
+                    "value": [
+                      {
+                        "name": "appGwPublicFrontendIp",
+                        "properties": {
+                          "privateIPAllocationMethod": "Dynamic",
+                          "publicIPAddress": {
+                            "id": "[reference(resourceId('Microsoft.Resources/deployments', take(format('applicationGatewayPublicIp-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.resourceId.value]"
+                          }
+                        }
+                      }
+                    ]
+                  },
+                  "frontendPorts": "[if(not(empty(parameters('base64Certificate'))), createObject('value', createArray(createObject('name', 'port_443', 'properties', createObject('port', 443)), createObject('name', 'port_80', 'properties', createObject('port', 80)))), createObject('value', createArray(createObject('name', 'port_80', 'properties', createObject('port', 80)))))]",
+                  "gatewayIPConfigurations": {
+                    "value": [
+                      {
+                        "name": "appGatewayIpConfig",
+                        "properties": {
+                          "subnet": {
+                            "id": "[parameters('applicationGatewaySubnetId')]"
+                          }
+                        }
+                      }
+                    ]
+                  },
+                  "httpListeners": "[if(empty(parameters('base64Certificate')), createObject('value', createArray(createObject('name', 'httpListener', 'properties', createObject('frontendIPConfiguration', createObject('id', format('{0}/frontendIPConfigurations/appGwPublicFrontendIp', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))), 'frontendPort', createObject('id', format('{0}/frontendPorts/port_80', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))), 'protocol', 'Http', 'hostnames', createArray(), 'requireServerNameIndication', false())))), createObject('value', createArray(createObject('name', 'httpsListener', 'properties', createObject('frontendIPConfiguration', createObject('id', format('{0}/frontendIPConfigurations/appGwPublicFrontendIp', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))), 'frontendPort', createObject('id', format('{0}/frontendPorts/port_443', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))), 'protocol', 'Https', 'sslCertificate', createObject('id', format('{0}/sslCertificates/{1}', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway), parameters('applicationGatewayFqdn'))), 'hostnames', createArray(), 'requireServerNameIndication', false())))))]",
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "managedIdentities": {
+                    "value": {
+                      "userAssignedResourceIds": [
+                        "[reference(resourceId('Microsoft.Resources/deployments', take(format('appGwUserAssignedIdentity-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.resourceId.value]"
+                      ]
+                    }
+                  },
+                  "probes": "[if(not(empty(parameters('applicationGatewayPrimaryBackendEndFqdn'))), createObject('value', createArray(createObject('name', 'webProbe', 'properties', createObject('protocol', 'Https', 'host', parameters('applicationGatewayPrimaryBackendEndFqdn'), 'path', parameters('appGatewayBackendHealthProbePath'), 'interval', 30, 'timeout', 30, 'unhealthyThreshold', 3, 'pickHostNameFromBackendHttpSettings', false(), 'minServers', 0, 'match', createObject('statusCodes', createArray('200-499')))))), createObject('value', null()))]",
+                  "requestRoutingRules": {
+                    "value": [
+                      {
+                        "name": "routingRules",
+                        "properties": {
+                          "ruleType": "Basic",
+                          "priority": 100,
+                          "httpListener": {
+                            "id": "[format('{0}/httpListeners/httpListener', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))]"
+                          },
+                          "backendAddressPool": {
+                            "id": "[format('{0}/backendAddressPools/acaServiceBackend', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))]"
+                          },
+                          "backendHttpSettings": {
+                            "id": "[format('{0}/backendHttpSettingsCollection/https', resourceId('Microsoft.Network/applicationGateways', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway))]"
+                          }
+                        }
+                      }
+                    ]
+                  },
+                  "sku": {
+                    "value": "WAF_v2"
+                  },
+                  "sslCertificates": "[if(not(empty(parameters('base64Certificate'))), createObject('value', createArray(createObject('name', parameters('applicationGatewayFqdn'), 'properties', createObject('keyVaultSecretId', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('keyVaultSubscriptionId'), variables('keyVaultResourceGroupName')), 'Microsoft.Resources/deployments', take(format('appGatewayAddCertificates-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.SecretUri.value)))), createObject('value', createArray()))]",
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "firewallPolicyId": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('appGwWafPolicy-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.resourceId.value]"
+                  },
+                  "sslPolicyType": {
+                    "value": "Predefined"
+                  },
+                  "sslPolicyName": {
+                    "value": "AppGwSslPolicy20220101"
+                  },
+                  "zones": {
+                    "value": [
+                      "1",
+                      "2",
+                      "3"
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.26.170.59819",
+                      "templateHash": "8087239342888324125"
+                    },
+                    "name": "Network Application Gateways",
+                    "description": "This module deploys a Network Application Gateway.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "managedIdentitiesType": {
+                      "type": "object",
+                      "properties": {
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "privateEndpointType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of the private endpoint."
+                            }
+                          },
+                          "location": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The location to deploy the private endpoint to."
+                            }
+                          },
+                          "privateLinkServiceConnectionName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of the private link connection to create."
+                            }
+                          },
+                          "service": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\"."
+                            }
+                          },
+                          "subnetResourceId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                            }
+                          },
+                          "privateDnsZoneGroupName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                            }
+                          },
+                          "privateDnsZoneResourceIds": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                            }
+                          },
+                          "isManualConnection": {
+                            "type": "bool",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. If Manual Private Link Connection is required."
+                            }
+                          },
+                          "manualConnectionRequestMessage": {
+                            "type": "string",
+                            "nullable": true,
+                            "maxLength": 140,
+                            "metadata": {
+                              "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                            }
+                          },
+                          "customDnsConfigs": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Required. Fqdn that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Custom DNS configurations."
+                            }
+                          },
+                          "ipConfigurations": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                            }
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                            }
+                          },
+                          "customNetworkInterfaceName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                            }
+                          },
+                          "lock": {
+                            "$ref": "#/definitions/lockType",
+                            "metadata": {
+                              "description": "Optional. Specify the type of lock."
+                            }
+                          },
+                          "roleAssignments": {
+                            "$ref": "#/definitions/roleAssignmentType",
+                            "metadata": {
+                              "description": "Optional. Array of role assignments to create."
+                            }
+                          },
+                          "tags": {
+                            "type": "object",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                            }
+                          },
+                          "enableTelemetry": {
+                            "type": "bool",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Enable/Disable usage telemetry for module."
+                            }
+                          },
+                          "resourceGroupName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "maxLength": 80,
+                      "metadata": {
+                        "description": "Required. Name of the Application Gateway."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentitiesType",
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "authenticationCertificates": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Authentication certificates of the application gateway resource."
+                      }
+                    },
+                    "autoscaleMaxCapacity": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "metadata": {
+                        "description": "Optional. Upper bound on number of Application Gateway capacity."
+                      }
+                    },
+                    "autoscaleMinCapacity": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "metadata": {
+                        "description": "Optional. Lower bound on number of Application Gateway capacity."
+                      }
+                    },
+                    "backendAddressPools": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Backend address pool of the application gateway resource."
+                      }
+                    },
+                    "backendHttpSettingsCollection": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Backend http settings of the application gateway resource."
+                      }
+                    },
+                    "customErrorConfigurations": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Custom error configurations of the application gateway resource."
+                      }
+                    },
+                    "enableFips": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether FIPS is enabled on the application gateway resource."
+                      }
+                    },
+                    "enableHttp2": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether HTTP2 is enabled on the application gateway resource."
+                      }
+                    },
+                    "firewallPolicyId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The resource ID of an associated firewall policy. Should be configured for security reasons."
+                      }
+                    },
+                    "frontendIPConfigurations": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Frontend IP addresses of the application gateway resource."
+                      }
+                    },
+                    "frontendPorts": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Frontend ports of the application gateway resource."
+                      }
+                    },
+                    "gatewayIPConfigurations": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Subnets of the application gateway resource."
+                      }
+                    },
+                    "enableRequestBuffering": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enable request buffering."
+                      }
+                    },
+                    "enableResponseBuffering": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enable response buffering."
+                      }
+                    },
+                    "httpListeners": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Http listeners of the application gateway resource."
+                      }
+                    },
+                    "loadDistributionPolicies": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Load distribution policies of the application gateway resource."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "$ref": "#/definitions/privateEndpointType",
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "privateLinkConfigurations": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. PrivateLink configurations on application gateway."
+                      }
+                    },
+                    "probes": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Probes of the application gateway resource."
+                      }
+                    },
+                    "redirectConfigurations": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Redirect configurations of the application gateway resource."
+                      }
+                    },
+                    "requestRoutingRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Request routing rules of the application gateway resource."
+                      }
+                    },
+                    "rewriteRuleSets": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Rewrite rules for the application gateway resource."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "defaultValue": "WAF_v2",
+                      "allowedValues": [
+                        "Standard_Small",
+                        "Standard_Medium",
+                        "Standard_Large",
+                        "WAF_Medium",
+                        "WAF_Large",
+                        "Standard_v2",
+                        "WAF_v2"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The name of the SKU for the Application Gateway."
+                      }
+                    },
+                    "capacity": {
+                      "type": "int",
+                      "defaultValue": 2,
+                      "minValue": 0,
+                      "maxValue": 10,
+                      "metadata": {
+                        "description": "Optional. The number of Application instances to be configured."
+                      }
+                    },
+                    "sslCertificates": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. SSL certificates of the application gateway resource."
+                      }
+                    },
+                    "sslPolicyCipherSuites": {
+                      "type": "array",
+                      "defaultValue": [
+                        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+                      ],
+                      "allowedValues": [
+                        "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
+                        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
+                        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
+                        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
+                        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
+                        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
+                        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
+                        "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
+                        "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
+                        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+                        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+                        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
+                        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                        "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+                        "TLS_RSA_WITH_AES_128_CBC_SHA",
+                        "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                        "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                        "TLS_RSA_WITH_AES_256_CBC_SHA",
+                        "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                        "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ssl cipher suites to be enabled in the specified order to application gateway."
+                      }
+                    },
+                    "sslPolicyMinProtocolVersion": {
+                      "type": "string",
+                      "defaultValue": "TLSv1_2",
+                      "allowedValues": [
+                        "TLSv1_0",
+                        "TLSv1_1",
+                        "TLSv1_2",
+                        "TLSv1_3"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ssl protocol enums."
+                      }
+                    },
+                    "sslPolicyName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "allowedValues": [
+                        "AppGwSslPolicy20150501",
+                        "AppGwSslPolicy20170401",
+                        "AppGwSslPolicy20170401S",
+                        "AppGwSslPolicy20220101",
+                        "AppGwSslPolicy20220101S",
+                        ""
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ssl predefined policy name enums."
+                      }
+                    },
+                    "sslPolicyType": {
+                      "type": "string",
+                      "defaultValue": "Custom",
+                      "allowedValues": [
+                        "Custom",
+                        "CustomV2",
+                        "Predefined"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Type of Ssl Policy."
+                      }
+                    },
+                    "sslProfiles": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. SSL profiles of the application gateway resource."
+                      }
+                    },
+                    "trustedClientCertificates": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Trusted client certificates of the application gateway resource."
+                      }
+                    },
+                    "trustedRootCertificates": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Trusted Root certificates of the application gateway resource."
+                      }
+                    },
+                    "urlPathMaps": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. URL path map of the application gateway resource."
+                      }
+                    },
+                    "webApplicationFirewallConfiguration": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Application gateway web application firewall configuration. Should be configured for security reasons."
+                      }
+                    },
+                    "zones": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. A list of availability zones denoting where the resource needs to come from."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource tags."
+                      }
+                    },
+                    "backendSettingsCollection": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Backend settings of the application gateway resource. For default limits, see [Application Gateway limits](https://learn.microsoft.com/en-us/azure/azure-subscription-service-limits#application-gateway-limits)."
+                      }
+                    },
+                    "listeners": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Listeners of the application gateway resource. For default limits, see [Application Gateway limits](https://learn.microsoft.com/en-us/azure/azure-subscription-service-limits#application-gateway-limits)."
+                      }
+                    },
+                    "routingRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Routing rules of the application gateway resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null()), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-appgw.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "applicationGateway": {
+                      "type": "Microsoft.Network/applicationGateways",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": "[union(createObject('authenticationCertificates', parameters('authenticationCertificates'), 'autoscaleConfiguration', if(and(greater(parameters('autoscaleMaxCapacity'), 0), greaterOrEquals(parameters('autoscaleMinCapacity'), 0)), createObject('maxCapacity', parameters('autoscaleMaxCapacity'), 'minCapacity', parameters('autoscaleMinCapacity')), null()), 'backendAddressPools', parameters('backendAddressPools'), 'backendHttpSettingsCollection', parameters('backendHttpSettingsCollection'), 'backendSettingsCollection', parameters('backendSettingsCollection'), 'customErrorConfigurations', parameters('customErrorConfigurations'), 'enableHttp2', parameters('enableHttp2'), 'firewallPolicy', if(not(empty(parameters('firewallPolicyId'))), createObject('id', parameters('firewallPolicyId')), null()), 'forceFirewallPolicyAssociation', not(empty(parameters('firewallPolicyId'))), 'frontendIPConfigurations', parameters('frontendIPConfigurations'), 'frontendPorts', parameters('frontendPorts'), 'gatewayIPConfigurations', parameters('gatewayIPConfigurations'), 'globalConfiguration', if(endsWith(parameters('sku'), 'v2'), createObject('enableRequestBuffering', parameters('enableRequestBuffering'), 'enableResponseBuffering', parameters('enableResponseBuffering')), null()), 'httpListeners', parameters('httpListeners'), 'loadDistributionPolicies', parameters('loadDistributionPolicies'), 'listeners', parameters('listeners'), 'privateLinkConfigurations', parameters('privateLinkConfigurations'), 'probes', parameters('probes'), 'redirectConfigurations', parameters('redirectConfigurations'), 'requestRoutingRules', parameters('requestRoutingRules'), 'routingRules', parameters('routingRules'), 'rewriteRuleSets', parameters('rewriteRuleSets'), 'sku', createObject('name', parameters('sku'), 'tier', if(endsWith(parameters('sku'), 'v2'), parameters('sku'), substring(parameters('sku'), 0, indexOf(parameters('sku'), '_'))), 'capacity', if(and(greater(parameters('autoscaleMaxCapacity'), 0), greaterOrEquals(parameters('autoscaleMinCapacity'), 0)), null(), parameters('capacity'))), 'sslCertificates', parameters('sslCertificates'), 'sslPolicy', if(not(equals(parameters('sslPolicyType'), 'Predefined')), createObject('cipherSuites', parameters('sslPolicyCipherSuites'), 'minProtocolVersion', parameters('sslPolicyMinProtocolVersion'), 'policyName', if(empty(parameters('sslPolicyName')), null(), parameters('sslPolicyName')), 'policyType', parameters('sslPolicyType')), createObject('policyName', if(empty(parameters('sslPolicyName')), null(), parameters('sslPolicyName')), 'policyType', parameters('sslPolicyType'))), 'sslProfiles', parameters('sslProfiles'), 'trustedClientCertificates', parameters('trustedClientCertificates'), 'trustedRootCertificates', parameters('trustedRootCertificates'), 'urlPathMaps', parameters('urlPathMaps')), if(parameters('enableFips'), createObject('enableFips', parameters('enableFips')), createObject()), if(not(empty(parameters('webApplicationFirewallConfiguration'))), createObject('webApplicationFirewallConfiguration', parameters('webApplicationFirewallConfiguration')), createObject()))]",
+                      "zones": "[parameters('zones')]"
+                    },
+                    "applicationGateway_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/applicationGateways/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "applicationGateway"
+                      ]
+                    },
+                    "applicationGateway_diagnosticSettings": {
+                      "copy": {
+                        "name": "applicationGateway_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/applicationGateways/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "applicationGateway"
+                      ]
+                    },
+                    "applicationGateway_roleAssignments": {
+                      "copy": {
+                        "name": "applicationGateway_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/applicationGateways/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/applicationGateways', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "applicationGateway"
+                      ]
+                    },
+                    "applicationGateway_privateEndpoints": {
+                      "copy": {
+                        "name": "applicationGateway_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-applicationGateway-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Network/applicationGateways', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Network/applicationGateways', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Network/applicationGateways', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Network/applicationGateways', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Network/applicationGateways', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroupName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                          },
+                          "privateDnsZoneResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "4120048060064073955"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "ipConfigurationsType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the resource that is unique within a resource group."
+                                    }
+                                  },
+                                  "properties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "groupId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                        }
+                                      },
+                                      "memberName": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                        }
+                                      },
+                                      "privateIPAddress": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                        }
+                                      }
+                                    },
+                                    "metadata": {
+                                      "description": "Required. Properties of private endpoint IP configurations."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnectionsType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the private link service connection."
+                                    }
+                                  },
+                                  "properties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "groupIds": {
+                                        "type": "array",
+                                        "metadata": {
+                                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                        }
+                                      },
+                                      "privateLinkServiceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of private link service."
+                                        }
+                                      },
+                                      "requestMessage": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                        }
+                                      }
+                                    },
+                                    "metadata": {
+                                      "description": "Required. Properties of private link service connection."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnectionsType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The name of the private link service connection."
+                                    }
+                                  },
+                                  "properties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "groupIds": {
+                                        "type": "array",
+                                        "metadata": {
+                                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                        }
+                                      },
+                                      "privateLinkServiceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of private link service."
+                                        }
+                                      },
+                                      "requestMessage": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                        }
+                                      }
+                                    },
+                                    "metadata": {
+                                      "description": "Required. Properties of private link service connection."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "fqdn": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Fqdn that resolves to private endpoint IP address."
+                                    }
+                                  },
+                                  "ipAddresses": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "metadata": {
+                                      "description": "Required. A list of private IP addresses of the private endpoint."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "$ref": "#/definitions/ipConfigurationsType",
+                              "metadata": {
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              }
+                            },
+                            "privateDnsZoneGroupName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                              }
+                            },
+                            "privateDnsZoneResourceIds": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              }
+                            },
+                            "customDnsConfigs": {
+                              "$ref": "#/definitions/customDnsConfigType",
+                              "metadata": {
+                                "description": "Optional. Custom DNS configurations."
+                              }
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                              "metadata": {
+                                "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                              }
+                            },
+                            "privateLinkServiceConnections": {
+                              "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                              "metadata": {
+                                "description": "Optional. A grouping of information about the connection to the remote resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                                  },
+                                  "privateDNSResourceIds": {
+                                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.25.53.49325",
+                                      "templateHash": "11244630631275470040"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDNSResourceIds": {
+                                      "type": "array",
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "privateDnsZoneConfigs",
+                                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                                        "input": {
+                                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                          "properties": {
+                                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2023-04-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "applicationGateway"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the application gateway."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the application gateway."
+                      },
+                      "value": "[resourceId('Microsoft.Network/applicationGateways', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the application gateway was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('applicationGateway', '2023-04-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('keyVaultSubscriptionId'), variables('keyVaultResourceGroupName')), 'Microsoft.Resources/deployments', take(format('appGatewayAddCertificates-Deployment-{0}', uniqueString(resourceGroup().id)), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('appGwWafPolicy-Deployment-{0}', uniqueString(resourceGroup().id)), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('applicationGatewayPublicIp-Deployment-{0}', uniqueString(resourceGroup().id)), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('appGwUserAssignedIdentity-Deployment-{0}', uniqueString(resourceGroup().id)), 64))]"
+              ],
+              "metadata": {
+                "description": "The Application Gateway."
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('appGwWafPolicy-Deployment-{0}', uniqueString(resourceGroup().id)), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[format('{0}Policy001', reference(resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.applicationGateway)]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "policySettings": {
+                    "value": {
+                      "fileUploadLimitInMb": 10,
+                      "state": "Enabled",
+                      "mode": "Prevention"
+                    }
+                  },
+                  "managedRules": {
+                    "value": {
+                      "managedRuleSets": [
+                        {
+                          "ruleSetType": "OWASP",
+                          "ruleSetVersion": "3.2",
+                          "ruleGroupOverrides": []
+                        },
+                        {
+                          "ruleSetType": "Microsoft_BotManagerRuleSet",
+                          "ruleSetVersion": "0.1"
+                        }
+                      ]
+                    }
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.26.54.24096",
+                      "templateHash": "15441807103053057108"
+                    },
+                    "name": "Application Gateway Web Application Firewall (WAF) Policies",
+                    "description": "This module deploys an Application Gateway Web Application Firewall (WAF) Policy.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Application Gateway WAF policy."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource tags."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "managedRules": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "Required. Describes the managedRules structure."
+                      }
+                    },
+                    "customRules": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom rules inside the policy."
+                      }
+                    },
+                    "policySettings": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The PolicySettings for policy."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-appgwwebappfirewallpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "applicationGatewayWAFPolicy": {
+                      "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "managedRules": "[coalesce(parameters('managedRules'), createObject())]",
+                        "customRules": "[parameters('customRules')]",
+                        "policySettings": "[parameters('policySettings')]"
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the application gateway WAF policy."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the application gateway WAF policy."
+                      },
+                      "value": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the application gateway WAF policy was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('applicationGatewayWAFPolicy', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('agwNamingDeployment-{0}', deployment().name), 64))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "applicationGatewayResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Azure Application Gateway."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('applicationGateway-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.resourceId.value]"
+            },
+            "applicationGatewayFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "The FQDN of the Azure Application Gateway."
+              },
+              "value": "[parameters('applicationGatewayFqdn')]"
+            },
+            "applicationGatewayPublicIp": {
+              "type": "string",
+              "metadata": {
+                "description": "The public IP address of the Azure Application Gateway."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('applicationGatewayPublicIp-Deployment-{0}', uniqueString(resourceGroup().id)), 64)), '2022-09-01').outputs.ipAddress.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('sampleApplication-{0}-deployment', deployment().name), 64))]",
+        "[subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64))]"
+      ]
+    },
+    {
+      "condition": "[equals(parameters('exposeContainerAppsWith'), 'frontDoor')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('frontDoor-{0}-deployment', deployment().name), 64)]",
+      "resourceGroup": "[variables('rgSpokeName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "environment": {
+            "value": "[parameters('environment')]"
+          },
+          "workloadName": {
+            "value": "[parameters('workloadName')]"
+          },
+          "containerAppsEnvironmentId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerAppsEnvironmentId.value]"
+          },
+          "frontDoorOriginHostName": "[if(parameters('deploySampleApplication'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('sampleApplication-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.helloWorldAppFqdn.value), createObject('value', ''))]",
+          "privateLinkSubnetId": {
+            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeInfraSubnetId.value]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "2374255941922404406"
+            }
+          },
+          "parameters": {
+            "workloadName": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 10,
+              "metadata": {
+                "description": "The name of the workload that is being deployed. Up to 10 characters long."
+              }
+            },
+            "environment": {
+              "type": "string",
+              "maxLength": 8,
+              "metadata": {
+                "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\"). Up to 8 characters long."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "The location where the resources will be created."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The tags to be assigned to the created resources."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Whether to enable deplotment telemetry."
+              }
+            },
+            "containerAppsEnvironmentId": {
+              "type": "string",
+              "metadata": {
+                "description": "The ID of the Container Apps environment to be used for the deployment. (e.g. /subscriptions/XXX/resourceGroups/XXX/providers/Microsoft.App/managedEnvironments/XXX)"
+              }
+            },
+            "privateLinkSubnetId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the subnet to be used for the private link service. (e.g. /subscriptions/XXX/resourceGroups/XXX/providers/Microsoft.Network/virtualNetworks/XXX/subnets/XXX)"
+              }
+            },
+            "frontDoorEndpointName": {
+              "type": "string",
+              "defaultValue": "fde-containerapps",
+              "metadata": {
+                "description": "The name of the front door endpoint to be created."
+              }
+            },
+            "frontDoorOriginGroupName": {
+              "type": "string",
+              "defaultValue": "containerapps-origin-group",
+              "metadata": {
+                "description": "The name of the front door origin group to be created."
+              }
+            },
+            "frontDoorOriginName": {
+              "type": "string",
+              "defaultValue": "containerapps-origin",
+              "metadata": {
+                "description": "The name of the front door origin to be created."
+              }
+            },
+            "frontDoorOriginRouteName": {
+              "type": "string",
+              "defaultValue": "containerapps-route",
+              "metadata": {
+                "description": "The name of the front door origin route to be created."
+              }
+            },
+            "frontDoorOriginHostName": {
+              "type": "string",
+              "metadata": {
+                "description": "The host name of the front door origin to be created."
+              }
+            }
+          },
+          "variables": {
+            "containerAppsEnvironmentTokens": "[split(parameters('containerAppsEnvironmentId'), '/')]",
+            "containerAppsEnvironmentSubscriptionId": "[variables('containerAppsEnvironmentTokens')[2]]",
+            "containerAppsEnvironmentResourceGroupName": "[variables('containerAppsEnvironmentTokens')[4]]",
+            "containerAppsEnvironmentName": "[variables('containerAppsEnvironmentTokens')[8]]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[take(format('frontDoorNamingDeployment-{0}', deployment().name), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "uniqueId": {
+                    "value": "[uniqueString(resourceGroup().id)]"
+                  },
+                  "environment": {
+                    "value": "[parameters('environment')]"
+                  },
+                  "workloadName": {
+                    "value": "[parameters('workloadName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "4794676376542080363"
+                    }
+                  },
+                  "parameters": {
+                    "workloadName": {
+                      "type": "string",
+                      "minLength": 2,
+                      "maxLength": 10,
+                      "metadata": {
+                        "description": "The name of the workloard that is being deployed. Up to 10 characters long."
+                      }
+                    },
+                    "environment": {
+                      "type": "string",
+                      "maxLength": 8,
+                      "metadata": {
+                        "description": "The name of the environment (e.g. \"dev\", \"test\", \"prod\", \"uat\", \"dr\", \"qa\") Up to 8 characters long."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location for all Resources."
+                      }
+                    },
+                    "uniqueId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness"
+                      }
+                    }
+                  },
+                  "variables": {
+                    "$fxv#0": "{\n    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations\n    \"resourceTypeAbbreviations\" : {\n        \"applicationGateway\": \"agw\",\n        \"applicationInsights\": \"appi\",\n        \"appService\": \"app\",\n        \"azureFirewall\": \"azfw\",\n        \"bastion\": \"bas\",\n        \"containerAppsEnvironment\": \"cae\",\n        \"containerRegistry\": \"cr\",\n        \"cosmosDbNoSql\": \"cosno\",\n        \"frontDoor\": \"afd\",\n        \"frontDoorEndpoint\": \"fde\",\n        \"frontDoorWaf\": \"fdfp\",\n        \"keyVault\": \"kv\",\n        \"logAnalyticsWorkspace\": \"log\",\n        \"managedIdentity\": \"id\",\n        \"networkInterface\": \"nic\",\n        \"networkSecurityGroup\": \"nsg\",\n        \"privateEndpoint\": \"pep\",\n        \"privateLinkService\": \"pls\",\n        \"publicIpAddress\": \"pip\",\n        \"resourceGroup\": \"rg\",\n        \"routeTable\": \"rt\",\n        \"serviceBus\": \"sb\",\n        \"serviceBusQueue\": \"sbq\",\n        \"serviceBusTopic\": \"sbt\",\n        \"storageAccount\": \"st\",\n        \"virtualMachine\": \"vm\",\n        \"virtualNetwork\": \"vnet\",\n        \"redisCache\": \"redis\",\n        \"cognitiveAccount\": \"cog\",\n        \"openAiDeployment\": \"oaidep\",\n        \"azureAISearch\": \"srch\",\n        \"documentIntelligence\": \"di\",\n        \"eventGridSystemTopic\": \"egst\",\n        \"eventGridSubscription\": \"evgs\"\n    },\n\n    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json\n    \"regionAbbreviations\" : {\n        \"australiacentral\": \"auc\",\n        \"australiacentral2\": \"auc2\",\n        \"australiaeast\": \"aue\",\n        \"australiasoutheast\": \"ause\",\n        \"brazilsouth\": \"brs\",\n        \"brazilsoutheast\": \"brse\",\n        \"canadacentral\": \"canc\",\n        \"canadaeast\": \"cane\",\n        \"centralindia\": \"cin\",\n        \"centralus\": \"cus\",\n        \"centraluseuap\": \"cuseuap\",\n        \"eastasia\": \"ea\",\n        \"eastus\": \"eus\",\n        \"eastus2\": \"eus2\",\n        \"eastus2euap\": \"eus2euap\",\n        \"francecentral\": \"frc\",\n        \"francesouth\": \"frs\",\n        \"germanynorth\": \"gern\",\n        \"germanywestcentral\": \"gerwc\",\n        \"japaneast\": \"jae\",\n        \"japanwest\": \"jaw\",\n        \"jioindiacentral\": \"jioinc\",\n        \"jioindiawest\": \"jioinw\",\n        \"koreacentral\": \"koc\",\n        \"koreasouth\": \"kors\",\n        \"northcentralus\": \"ncus\",\n        \"northeurope\": \"neu\",\n        \"norwayeast\": \"nore\",\n        \"norwaywest\": \"norw\",\n        \"southafricanorth\": \"san\",\n        \"southafricawest\": \"saw\",\n        \"southcentralus\": \"scus\",\n        \"southeastasia\": \"sea\",\n        \"southindia\": \"sin\",\n        \"swedencentral\": \"swc\",\n        \"switzerlandnorth\": \"swn\",\n        \"switzerlandwest\": \"sww\",\n        \"uaecentral\": \"uaec\",\n        \"uaenorth\": \"uaen\",\n        \"uksouth\": \"uks\",\n        \"ukwest\": \"ukw\",\n        \"westcentralus\": \"wcus\",\n        \"westeurope\": \"weu\",\n        \"westindia\": \"win\",\n        \"westus\": \"wus\",\n        \"westus2\": \"wus2\",\n        \"westus3\": \"wus3\"\n    }\n}",
+                    "naming": "[json(variables('$fxv#0'))]",
+                    "uniqueIdShort": "[substring(parameters('uniqueId'), 0, 5)]",
+                    "resourceTypeToken": "RES_TYPE",
+                    "namingBase": "[format('{0}-{1}-{2}-{3}', variables('resourceTypeToken'), parameters('workloadName'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseUnique": "[format('{0}-{1}-{2}-{3}-{4}', variables('resourceTypeToken'), parameters('workloadName'), variables('uniqueIdShort'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "namingBaseNoWorkloadName": "[format('{0}-{1}-{2}', variables('resourceTypeToken'), parameters('environment'), variables('naming').regionAbbreviations[toLower(parameters('location'))])]",
+                    "resourceTypeAbbreviations": "[variables('naming').resourceTypeAbbreviations]",
+                    "keyVaultName": "[take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault), 24)]",
+                    "resourceNames": {
+                      "vnetSpoke": "[format('{0}-spoke', replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "vnetHub": "[format('{0}-hub', replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualNetwork))]",
+                      "applicationGateway": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway)]",
+                      "applicationGatewayPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayUserAssignedIdentity": "[format('{0}-{1}-KeyVaultSecretUser', variables('naming').resourceTypeAbbreviations.managedIdentity, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "applicationGatewayNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationGateway))]",
+                      "pepNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.privateEndpoint))]",
+                      "applicationInsights": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.applicationInsights)]",
+                      "azureFirewall": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall)]",
+                      "azureFirewallPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureFirewall))]",
+                      "bastion": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion)]",
+                      "bastionNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "bastionPip": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.publicIpAddress, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.bastion))]",
+                      "containerAppsEnvironment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment)]",
+                      "containerAppsEnvironmentNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerAppsEnvironment))]",
+                      "containerRegistry": "[take(toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')), 50)]",
+                      "containerRegistryPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "containerRegistryUserAssignedIdentity": "[format('{0}-{1}-AcrPull', variables('naming').resourceTypeAbbreviations.managedIdentity, toLower(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.containerRegistry), '-', '')))]",
+                      "redisCache": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache)]",
+                      "redisCachePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.redisCache))]",
+                      "openAiAccount": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cognitiveAccount)]",
+                      "openAiDeployment": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.openAiDeployment)]",
+                      "cosmosDbNoSql": "[toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44))]",
+                      "cosmosDbNoSqlPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(take(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.cosmosDbNoSql), 44)))]",
+                      "frontDoorProfile": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "keyVault": "[if(endsWith(variables('keyVaultName'), '-'), take(variables('keyVaultName'), 23), variables('keyVaultName'))]",
+                      "keyVaultPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.keyVault))]",
+                      "logAnalyticsWorkspace": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.logAnalyticsWorkspace)]",
+                      "routeTable": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.routeTable)]",
+                      "serviceBus": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus)]",
+                      "serviceBusPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.serviceBus))]",
+                      "storageAccount": "[toLower(take(replace(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount), '-', ''), 24))]",
+                      "storageAccountPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, toLower(replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.storageAccount)))]",
+                      "vmJumpBox": "[replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine)]",
+                      "vmJumpBoxNsg": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkSecurityGroup, replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "vmJumpBoxNic": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.networkInterface, replace(variables('namingBaseNoWorkloadName'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.virtualMachine))]",
+                      "frontDoor": "[replace(variables('namingBase'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.frontDoor)]",
+                      "azureAISearch": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch)]",
+                      "azureAISearchPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.azureAISearch))]",
+                      "documentIntelligence": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence)]",
+                      "documentIntelligencePep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.documentIntelligence))]",
+                      "eventGridSystemTopic": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic)]",
+                      "eventGridSystemTopicPep": "[format('{0}-{1}', variables('naming').resourceTypeAbbreviations.privateEndpoint, replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSystemTopic))]",
+                      "eventGridSubscription": "[replace(variables('namingBaseUnique'), variables('resourceTypeToken'), variables('naming').resourceTypeAbbreviations.eventGridSubscription)]"
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourcesNames": {
+                      "type": "object",
+                      "value": "[variables('resourceNames')]"
+                    },
+                    "resourceTypeAbbreviations": {
+                      "type": "object",
+                      "value": "[variables('resourceTypeAbbreviations')]"
+                    }
+                  }
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('privateLinkServiceFrontDoorDeployment-{0}', uniqueString(resourceGroup().id))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "containerAppsDefaultDomainName": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('containerAppsEnvironmentSubscriptionId'), variables('containerAppsEnvironmentResourceGroupName')), 'Microsoft.App/managedEnvironments', variables('containerAppsEnvironmentName')), '2024-03-01').defaultDomain]"
+                  },
+                  "containerAppsEnvironmentSubscriptionId": {
+                    "value": "[variables('containerAppsEnvironmentSubscriptionId')]"
+                  },
+                  "privateLinkServiceName": {
+                    "value": "[format('{0}-{1}', reference(resourceId('Microsoft.Resources/deployments', take(format('frontDoorNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourceTypeAbbreviations.value.privateLinkService, reference(resourceId('Microsoft.Resources/deployments', take(format('frontDoorNamingDeployment-{0}', deployment().name), 64)), '2022-09-01').outputs.resourcesNames.value.frontDoor)]"
+                  },
+                  "privateLinkSubnetId": {
+                    "value": "[parameters('privateLinkSubnetId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "13579081567653218345"
+                    }
+                  },
+                  "parameters": {
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "The location where the resources will be created."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The tags to be assigned to the created resources."
+                      }
+                    },
+                    "privateLinkServiceName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private link service to create."
+                      }
+                    },
+                    "privateLinkSubnetId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "SubnetId used to configure private link service."
+                      }
+                    },
+                    "containerAppsDefaultDomainName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure Container Apps Environment Default Domain Name"
+                      }
+                    },
+                    "containerAppsEnvironmentSubscriptionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure Container Apps Environment Subscription Id"
+                      }
+                    }
+                  },
+                  "variables": {
+                    "containerAppsDefaultDomainArray": "[split(parameters('containerAppsDefaultDomainName'), '.')]",
+                    "containerAppsNameIdentifier": "[variables('containerAppsDefaultDomainArray')[sub(lastIndexOf(variables('containerAppsDefaultDomainArray'), parameters('location')), 1)]]",
+                    "containerAppsManagedResourceGroup": "[format('MC_{0}-rg_{1}_{2}', variables('containerAppsNameIdentifier'), variables('containerAppsNameIdentifier'), parameters('location'))]"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Network/privateLinkServices",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateLinkServiceName')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "loadBalancerFrontendIpConfigurations": [
+                          {
+                            "id": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('containerAppsEnvironmentSubscriptionId'), variables('containerAppsManagedResourceGroup')), 'Microsoft.Network/loadBalancers', 'kubernetes-internal'), '2021-05-01').frontendIPConfigurations[0].id]"
+                          }
+                        ],
+                        "ipConfigurations": [
+                          {
+                            "name": "snet-provider-default-1",
+                            "properties": {
+                              "privateIPAllocationMethod": "Dynamic",
+                              "subnet": {
+                                "id": "[parameters('privateLinkSubnetId')]"
+                              },
+                              "primary": true,
+                              "privateIPAddressVersion": "IPv4"
+                            }
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "privateLinkServiceId": {
+                      "type": "string",
+                      "value": "[resourceId('Microsoft.Network/privateLinkServices', parameters('privateLinkServiceName'))]"
+                    },
+                    "privateEndpointConnections": {
+                      "type": "array",
+                      "value": "[reference(resourceId('Microsoft.Network/privateLinkServices', parameters('privateLinkServiceName')), '2023-11-01').privateEndpointConnections]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', take(format('frontDoorNamingDeployment-{0}', deployment().name), 64))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('frontDoorDeployment-{0}', uniqueString(resourceGroup().id))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "dep-test-cdnpmax"
+                  },
+                  "location": {
+                    "value": "Global"
+                  },
+                  "sku": {
+                    "value": "Premium_AzureFrontDoor"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "originResponseTimeoutSeconds": {
+                    "value": 60
+                  },
+                  "endpointProperties": {
+                    "value": {
+                      "contentTypesToCompress": [
+                        "application/javascript",
+                        "application/json",
+                        "application/x-javascript",
+                        "application/xml",
+                        "text/css",
+                        "text/html",
+                        "text/javascript",
+                        "text/plain"
+                      ],
+                      "geoFilters": [],
+                      "isCompressionEnabled": true,
+                      "isHttpAllowed": true,
+                      "isHttpsAllowed": true,
+                      "queryStringCachingBehavior": "IgnoreQueryString"
+                    }
+                  },
+                  "originGroups": "[if(not(empty(parameters('frontDoorOriginHostName'))), createObject('value', createArray(createObject('name', parameters('frontDoorOriginGroupName'), 'loadBalancingSettings', createObject('sampleSize', 4, 'successfulSamplesRequired', 3, 'additionalLatencyInMilliseconds', 50), 'healthProbeSettings', createObject('probePath', '/', 'probeRequestType', 'HEAD', 'probeProtocol', 'Https', 'probeIntervalInSeconds', 100), 'sessionAffinityState', 'Disabled', 'origins', createArray(createObject('name', parameters('frontDoorOriginName'), 'hostName', parameters('frontDoorOriginHostName'), 'httpPort', 80, 'httpsPort', 443, 'originHostHeader', parameters('frontDoorOriginHostName'), 'priority', 1, 'weight', 1000, 'enabledState', 'Enabled', 'sharedPrivateLinkResource', createObject('privateLink', createObject('id', reference(resourceId('Microsoft.Resources/deployments', format('privateLinkServiceFrontDoorDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.privateLinkServiceId.value), 'privateLinkLocation', parameters('location'), 'requestMessage', 'frontdoor'), 'enforceCertificateNameCheck', true()))))), createObject('value', createArray()))]",
+                  "afdEndpoints": {
+                    "value": [
+                      {
+                        "name": "[parameters('frontDoorEndpointName')]",
+                        "originGroup": "[parameters('frontDoorOriginGroupName')]",
+                        "enabledState": "Enabled",
+                        "routes": [
+                          {
+                            "name": "[parameters('frontDoorOriginRouteName')]",
+                            "originPath": "/",
+                            "ruleSets": [],
+                            "supportedProtocols": [
+                              "Http",
+                              "Https"
+                            ],
+                            "patternsToMatch": [
+                              "/*"
+                            ],
+                            "forwardingProtocol": "HttpsOnly",
+                            "linkToDefaultDomain": "Enabled",
+                            "httpsRedirect": "Enabled",
+                            "enabledState": "Enabled"
+                          }
+                        ]
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.27.1.19265",
+                      "templateHash": "10155723221995510314"
+                    },
+                    "name": "CDN Profiles",
+                    "description": "This module deploys a CDN Profile.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the CDN profile."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Custom_Verizon",
+                        "Premium_AzureFrontDoor",
+                        "Premium_Verizon",
+                        "StandardPlus_955BandWidth_ChinaCdn",
+                        "StandardPlus_AvgBandWidth_ChinaCdn",
+                        "StandardPlus_ChinaCdn",
+                        "Standard_955BandWidth_ChinaCdn",
+                        "Standard_AvgBandWidth_ChinaCdn",
+                        "Standard_AzureFrontDoor",
+                        "Standard_ChinaCdn",
+                        "Standard_Microsoft",
+                        "Standard_Verizon"
+                      ],
+                      "metadata": {
+                        "description": "Required. The pricing tier (defines a CDN provider, feature list and rate) of the CDN profile."
+                      }
+                    },
+                    "originResponseTimeoutSeconds": {
+                      "type": "int",
+                      "defaultValue": 60,
+                      "metadata": {
+                        "description": "Optional. Send and receive timeout on forwarding request to the origin."
+                      }
+                    },
+                    "endpointName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Name of the endpoint under the profile which is unique globally."
+                      }
+                    },
+                    "endpointProperties": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Endpoint properties (see https://learn.microsoft.com/en-us/azure/templates/microsoft.cdn/profiles/endpoints?pivots=deployment-language-bicep#endpointproperties for details)."
+                      }
+                    },
+                    "secrets": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of secret objects."
+                      }
+                    },
+                    "customDomains": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of custom domain objects."
+                      }
+                    },
+                    "originGroups": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Conditional. Array of origin group objects. Required if the afdEndpoints is specified."
+                      }
+                    },
+                    "ruleSets": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of rule set objects."
+                      }
+                    },
+                    "afdEndpoints": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of AFD endpoint objects."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Endpoint tags."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "CDN Endpoint Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '426e0c7f-0c7e-4658-b36f-ff54d6c29b45')]",
+                      "CDN Endpoint Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '871e35f6-b5c1-49cc-a043-bde969a0f2cd')]",
+                      "CDN Profile Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ec156ff8-a8d1-4d15-830c-5b80698ca432')]",
+                      "CDN Profile Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8f96442b-4075-438f-813d-ad51ab4019af')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.cdn-profile.{0}.{1}', replace('0.3.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "profile": {
+                      "type": "Microsoft.Cdn/profiles",
+                      "apiVersion": "2023-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "sku": {
+                        "name": "[parameters('sku')]"
+                      },
+                      "properties": {
+                        "originResponseTimeoutSeconds": "[parameters('originResponseTimeoutSeconds')]"
+                      },
+                      "tags": "[parameters('tags')]"
+                    },
+                    "profile_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Cdn/profiles/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "profile"
+                      ]
+                    },
+                    "profile_roleAssignments": {
+                      "copy": {
+                        "name": "profile_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Cdn/profiles/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Cdn/profiles', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "profile"
+                      ]
+                    },
+                    "profile_endpoint": {
+                      "condition": "[not(empty(parameters('endpointProperties')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Profile-Endpoint', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('endpointName'), format('{0}-endpoint', parameters('name')))]"
+                          },
+                          "properties": {
+                            "value": "[coalesce(parameters('endpointProperties'), createObject())]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "profileName": {
+                            "value": "[parameters('name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "6907263116726609492"
+                            },
+                            "name": "CDN Profiles Endpoints",
+                            "description": "This module deploys a CDN Profile Endpoint.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "profileName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent CDN profile. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the endpoint under the profile which is unique globally."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Resource location."
+                              }
+                            },
+                            "properties": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "Required. Endpoint properties (see https://learn.microsoft.com/en-us/azure/templates/microsoft.cdn/profiles/endpoints?pivots=deployment-language-bicep#endpointproperties for details)."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Endpoint tags."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "profile": {
+                              "existing": true,
+                              "type": "Microsoft.Cdn/profiles",
+                              "apiVersion": "2021-06-01",
+                              "name": "[parameters('profileName')]"
+                            },
+                            "endpoint": {
+                              "type": "Microsoft.Cdn/profiles/endpoints",
+                              "apiVersion": "2021-06-01",
+                              "name": "[format('{0}/{1}', parameters('profileName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": "[parameters('properties')]",
+                              "tags": "[parameters('tags')]",
+                              "dependsOn": [
+                                "profile"
+                              ]
+                            },
+                            "endpoint_origins": {
+                              "copy": {
+                                "name": "endpoint_origins",
+                                "count": "[length(parameters('properties').origins)]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-origins-{1}', parameters('name'), parameters('properties').origins[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "profileName": {
+                                    "value": "[parameters('profileName')]"
+                                  },
+                                  "endpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[parameters('properties').origins[copyIndex()].name]"
+                                  },
+                                  "hostName": {
+                                    "value": "[parameters('properties').origins[copyIndex()].properties.hostName]"
+                                  },
+                                  "httpPort": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'httpPort')]"
+                                  },
+                                  "httpsPort": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'httpsPort')]"
+                                  },
+                                  "enabled": {
+                                    "value": "[parameters('properties').origins[copyIndex()].properties.enabled]"
+                                  },
+                                  "priority": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'priority')]"
+                                  },
+                                  "weight": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'weight')]"
+                                  },
+                                  "originHostHeader": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'originHostHeader')]"
+                                  },
+                                  "privateLinkAlias": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'privateLinkAlias')]"
+                                  },
+                                  "privateLinkLocation": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'privateLinkLocation')]"
+                                  },
+                                  "privateLinkResourceId": {
+                                    "value": "[tryGet(parameters('properties').origins[copyIndex()].properties, 'privateLinkResourceId')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "2422401530872933264"
+                                    },
+                                    "name": "CDN Profiles Endpoints Origins",
+                                    "description": "This module deploys a CDN Profile Endpoint Origin.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "endpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the CDN Endpoint."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the origin."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether the origin is enabled for load balancing."
+                                      }
+                                    },
+                                    "hostName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The hostname of the origin."
+                                      }
+                                    },
+                                    "httpPort": {
+                                      "type": "int",
+                                      "defaultValue": 80,
+                                      "metadata": {
+                                        "description": "Optional. The HTTP port of the origin."
+                                      }
+                                    },
+                                    "httpsPort": {
+                                      "type": "int",
+                                      "defaultValue": 443,
+                                      "metadata": {
+                                        "description": "Optional. The HTTPS port of the origin."
+                                      }
+                                    },
+                                    "priority": {
+                                      "type": "int",
+                                      "defaultValue": -1,
+                                      "metadata": {
+                                        "description": "Conditional. The priority of origin in given origin group for load balancing. Required if `weight` is provided."
+                                      }
+                                    },
+                                    "weight": {
+                                      "type": "int",
+                                      "defaultValue": -1,
+                                      "metadata": {
+                                        "description": "Conditional. The weight of the origin used for load balancing. Required if `priority` is provided."
+                                      }
+                                    },
+                                    "privateLinkAlias": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The private link alias of the origin. Required if privateLinkLocation is provided."
+                                      }
+                                    },
+                                    "privateLinkLocation": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The private link location of the origin. Required if privateLinkAlias is provided."
+                                      }
+                                    },
+                                    "privateLinkResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private link resource ID of the origin."
+                                      }
+                                    },
+                                    "originHostHeader": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The host header value sent to the origin."
+                                      }
+                                    },
+                                    "profileName": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the CDN profile. Default to \"default\"."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "profile": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles",
+                                      "apiVersion": "2021-06-01",
+                                      "name": "[parameters('profileName')]"
+                                    },
+                                    "endpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/endpoints",
+                                      "apiVersion": "2021-06-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), parameters('endpointName'))]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "origin": {
+                                      "type": "Microsoft.Cdn/profiles/endpoints/origins",
+                                      "apiVersion": "2021-06-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('profileName'), parameters('endpointName'), parameters('name'))]",
+                                      "properties": "[union(createObject('hostName', parameters('hostName'), 'httpPort', parameters('httpPort'), 'enabled', parameters('enabled'), 'httpsPort', parameters('httpsPort')), if(or(greater(parameters('priority'), 0), greater(parameters('weight'), 0)), createObject('priority', parameters('priority'), 'weight', parameters('weight')), createObject()), if(and(not(empty(parameters('privateLinkAlias'))), not(empty(parameters('privateLinkLocation')))), createObject('privateLinkAlias', parameters('privateLinkAlias'), 'privateLinkLocation', parameters('privateLinkLocation')), createObject()), if(not(empty(parameters('privateLinkResourceId'))), createObject('privateLinkResourceId', parameters('privateLinkResourceId')), createObject()), if(not(empty(parameters('originHostHeader'))), createObject('originHostHeader', parameters('originHostHeader')), createObject()))]",
+                                      "dependsOn": [
+                                        "endpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Cdn/profiles/endpoints/origins', parameters('profileName'), parameters('endpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the endpoint was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('endpoint', '2021-06-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "endpoint",
+                                "profile"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Cdn/profiles/endpoints', parameters('profileName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the endpoint was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('endpoint', '2021-06-01', 'full').location]"
+                            },
+                            "endpointProperties": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "The properties of the endpoint."
+                              },
+                              "value": "[reference('endpoint')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "profile"
+                      ]
+                    },
+                    "profile_secrets": {
+                      "copy": {
+                        "name": "profile_secrets",
+                        "count": "[length(parameters('secrets'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Profile-Secret-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('secrets')[copyIndex()].name]"
+                          },
+                          "profileName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "type": {
+                            "value": "[parameters('secrets')[copyIndex()].type]"
+                          },
+                          "secretSourceResourceId": {
+                            "value": "[parameters('secrets')[copyIndex()].secretSourceResourceId]"
+                          },
+                          "subjectAlternativeNames": {
+                            "value": "[tryGet(parameters('secrets')[copyIndex()], 'subjectAlternativeNames')]"
+                          },
+                          "useLatestVersion": {
+                            "value": "[tryGet(parameters('secrets')[copyIndex()], 'useLatestVersion')]"
+                          },
+                          "secretVersion": {
+                            "value": "[parameters('secrets')[copyIndex()].secretVersion]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "8969856235939919174"
+                            },
+                            "name": "CDN Profiles Secret",
+                            "description": "This module deploys a CDN Profile Secret.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the secrect."
+                              }
+                            },
+                            "profileName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent CDN profile. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "defaultValue": "AzureFirstPartyManagedCertificate",
+                              "allowedValues": [
+                                "AzureFirstPartyManagedCertificate",
+                                "CustomerCertificate",
+                                "ManagedCertificate",
+                                "UrlSigningKey"
+                              ],
+                              "metadata": {
+                                "description": "Required. The type of the secrect."
+                              }
+                            },
+                            "secretSourceResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Conditional. The resource ID of the secret source. Required if the `type` is \"CustomerCertificate\"."
+                              }
+                            },
+                            "secretVersion": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The version of the secret."
+                              }
+                            },
+                            "subjectAlternativeNames": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The subject alternative names of the secrect."
+                              }
+                            },
+                            "useLatestVersion": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether to use the latest version of the secrect."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Cdn/profiles/secrets",
+                              "apiVersion": "2023-05-01",
+                              "name": "[format('{0}/{1}', parameters('profileName'), parameters('name'))]",
+                              "properties": {
+                                "parameters": "[if(equals(parameters('type'), 'CustomerCertificate'), createObject('type', parameters('type'), 'secretSource', createObject('id', parameters('secretSourceResourceId')), 'secretVersion', parameters('secretVersion'), 'subjectAlternativeNames', parameters('subjectAlternativeNames'), 'useLatestVersion', parameters('useLatestVersion')), null())]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the secrect."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the secrect."
+                              },
+                              "value": "[resourceId('Microsoft.Cdn/profiles/secrets', parameters('profileName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the secret was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "profile"
+                      ]
+                    },
+                    "profile_customDomains": {
+                      "copy": {
+                        "name": "profile_customDomains",
+                        "count": "[length(parameters('customDomains'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-CustomDomain-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('customDomains')[copyIndex()].name]"
+                          },
+                          "profileName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "hostName": {
+                            "value": "[parameters('customDomains')[copyIndex()].hostName]"
+                          },
+                          "azureDnsZoneResourceId": {
+                            "value": "[tryGet(parameters('customDomains')[copyIndex()], 'azureDnsZoneResourceId')]"
+                          },
+                          "extendedProperties": {
+                            "value": "[tryGet(parameters('customDomains')[copyIndex()], 'extendedProperties')]"
+                          },
+                          "certificateType": {
+                            "value": "[parameters('customDomains')[copyIndex()].certificateType]"
+                          },
+                          "minimumTlsVersion": {
+                            "value": "[tryGet(parameters('customDomains')[copyIndex()], 'minimumTlsVersion')]"
+                          },
+                          "preValidatedCustomDomainResourceId": {
+                            "value": "[tryGet(parameters('customDomains')[copyIndex()], 'preValidatedCustomDomainResourceId')]"
+                          },
+                          "secretName": {
+                            "value": "[tryGet(parameters('customDomains')[copyIndex()], 'secretName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "4987993668641975476"
+                            },
+                            "name": "CDN Profiles Custom Domains",
+                            "description": "This module deploys a CDN Profile Custom Domains.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the custom domain."
+                              }
+                            },
+                            "profileName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the CDN profile."
+                              }
+                            },
+                            "hostName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The host name of the domain. Must be a domain name."
+                              }
+                            },
+                            "azureDnsZoneResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optonal. Resource reference to the Azure DNS zone."
+                              }
+                            },
+                            "extendedProperties": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Key-Value pair representing migration properties for domains."
+                              }
+                            },
+                            "preValidatedCustomDomainResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource reference to the Azure resource where custom domain ownership was prevalidated."
+                              }
+                            },
+                            "certificateType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "CustomerCertificate",
+                                "ManagedCertificate"
+                              ],
+                              "metadata": {
+                                "description": "Required. The type of the certificate used for secure delivery."
+                              }
+                            },
+                            "minimumTlsVersion": {
+                              "type": "string",
+                              "defaultValue": "TLS12",
+                              "allowedValues": [
+                                "TLS10",
+                                "TLS12"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The minimum TLS version required for the custom domain. Default value: TLS12."
+                              }
+                            },
+                            "secretName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The name of the secret. ie. subs/rg/profile/secret."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Cdn/profiles/customDomains",
+                              "apiVersion": "2023-05-01",
+                              "name": "[format('{0}/{1}', parameters('profileName'), parameters('name'))]",
+                              "properties": {
+                                "azureDnsZone": "[if(not(empty(parameters('azureDnsZoneResourceId'))), createObject('id', parameters('azureDnsZoneResourceId')), null())]",
+                                "extendedProperties": "[if(not(empty(parameters('extendedProperties'))), parameters('extendedProperties'), null())]",
+                                "hostName": "[parameters('hostName')]",
+                                "preValidatedCustomDomainResourceId": "[if(not(empty(parameters('preValidatedCustomDomainResourceId'))), createObject('id', parameters('preValidatedCustomDomainResourceId')), null())]",
+                                "tlsSettings": {
+                                  "certificateType": "[parameters('certificateType')]",
+                                  "minimumTlsVersion": "[parameters('minimumTlsVersion')]",
+                                  "secret": "[if(not(empty(parameters('secretName'))), createObject('id', resourceId('Microsoft.Cdn/profiles/secrets', parameters('profileName'), parameters('secretName'))), null())]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the custom domain."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource id of the custom domain."
+                              },
+                              "value": "[resourceId('Microsoft.Cdn/profiles/customDomains', parameters('profileName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the custom domain was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "profile",
+                        "profile_secrets"
+                      ]
+                    },
+                    "profile_originGroups": {
+                      "copy": {
+                        "name": "profile_originGroups",
+                        "count": "[length(parameters('originGroups'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Profile-OriginGroup-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('originGroups')[copyIndex()].name]"
+                          },
+                          "profileName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "loadBalancingSettings": {
+                            "value": "[parameters('originGroups')[copyIndex()].loadBalancingSettings]"
+                          },
+                          "healthProbeSettings": {
+                            "value": "[tryGet(parameters('originGroups')[copyIndex()], 'healthProbeSettings')]"
+                          },
+                          "sessionAffinityState": {
+                            "value": "[tryGet(parameters('originGroups')[copyIndex()], 'sessionAffinityState')]"
+                          },
+                          "trafficRestorationTimeToHealedOrNewEndpointsInMinutes": {
+                            "value": "[tryGet(parameters('originGroups')[copyIndex()], 'trafficRestorationTimeToHealedOrNewEndpointsInMinutes')]"
+                          },
+                          "origins": {
+                            "value": "[parameters('originGroups')[copyIndex()].origins]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "15134351122358254660"
+                            },
+                            "name": "CDN Profiles Origin Group",
+                            "description": "This module deploys a CDN Profile Origin Group.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the origin group."
+                              }
+                            },
+                            "profileName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the CDN profile."
+                              }
+                            },
+                            "healthProbeSettings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Health probe settings to the origin that is used to determine the health of the origin."
+                              }
+                            },
+                            "loadBalancingSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "Required. Load balancing settings for a backend pool."
+                              }
+                            },
+                            "sessionAffinityState": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether to allow session affinity on this host."
+                              }
+                            },
+                            "trafficRestorationTimeToHealedOrNewEndpointsInMinutes": {
+                              "type": "int",
+                              "defaultValue": 10,
+                              "metadata": {
+                                "description": "Optional. Time in minutes to shift the traffic to the endpoint gradually when an unhealthy endpoint comes healthy or a new endpoint is added. Default is 10 mins."
+                              }
+                            },
+                            "origins": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. The list of origins within the origin group."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "profile": {
+                              "existing": true,
+                              "type": "Microsoft.Cdn/profiles",
+                              "apiVersion": "2023-05-01",
+                              "name": "[parameters('profileName')]"
+                            },
+                            "originGroup": {
+                              "type": "Microsoft.Cdn/profiles/originGroups",
+                              "apiVersion": "2023-05-01",
+                              "name": "[format('{0}/{1}', parameters('profileName'), parameters('name'))]",
+                              "properties": {
+                                "healthProbeSettings": "[parameters('healthProbeSettings')]",
+                                "loadBalancingSettings": "[parameters('loadBalancingSettings')]",
+                                "sessionAffinityState": "[parameters('sessionAffinityState')]",
+                                "trafficRestorationTimeToHealedOrNewEndpointsInMinutes": "[parameters('trafficRestorationTimeToHealedOrNewEndpointsInMinutes')]"
+                              },
+                              "dependsOn": [
+                                "profile"
+                              ]
+                            },
+                            "originGroup_origins": {
+                              "copy": {
+                                "name": "originGroup_origins",
+                                "count": "[length(parameters('origins'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-OriginGroup-Origin-{1}', uniqueString(deployment().name), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('origins')[copyIndex()].name]"
+                                  },
+                                  "profileName": {
+                                    "value": "[parameters('profileName')]"
+                                  },
+                                  "hostName": {
+                                    "value": "[parameters('origins')[copyIndex()].hostName]"
+                                  },
+                                  "originGroupName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "enabledState": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'enabledState')]"
+                                  },
+                                  "enforceCertificateNameCheck": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'enforceCertificateNameCheck')]"
+                                  },
+                                  "httpPort": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'httpPort')]"
+                                  },
+                                  "httpsPort": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'httpsPort')]"
+                                  },
+                                  "originHostHeader": {
+                                    "value": "[coalesce(tryGet(parameters('origins')[copyIndex()], 'originHostHeader'), parameters('origins')[copyIndex()].hostName)]"
+                                  },
+                                  "priority": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'priority')]"
+                                  },
+                                  "weight": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'weight')]"
+                                  },
+                                  "sharedPrivateLinkResource": {
+                                    "value": "[tryGet(parameters('origins')[copyIndex()], 'sharedPrivateLinkResource')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "13403133934817379620"
+                                    },
+                                    "name": "CDN Profiles Origin",
+                                    "description": "This module deploys a CDN Profile Origin.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the origion."
+                                      }
+                                    },
+                                    "profileName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the CDN profile."
+                                      }
+                                    },
+                                    "originGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the group."
+                                      }
+                                    },
+                                    "enabledState": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether to enable health probes to be made against backends defined under backendPools. Health probes can only be disabled if there is a single enabled backend in single enabled backend pool."
+                                      }
+                                    },
+                                    "enforceCertificateNameCheck": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether to enable certificate name check at origin level."
+                                      }
+                                    },
+                                    "hostName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The address of the origin. Domain names, IPv4 addresses, and IPv6 addresses are supported.This should be unique across all origins in an endpoint."
+                                      }
+                                    },
+                                    "httpPort": {
+                                      "type": "int",
+                                      "defaultValue": 80,
+                                      "metadata": {
+                                        "description": "Optional. The value of the HTTP port. Must be between 1 and 65535."
+                                      }
+                                    },
+                                    "httpsPort": {
+                                      "type": "int",
+                                      "defaultValue": 443,
+                                      "metadata": {
+                                        "description": "Optional. The value of the HTTPS port. Must be between 1 and 65535."
+                                      }
+                                    },
+                                    "originHostHeader": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The host header value sent to the origin with each request. If you leave this blank, the request hostname determines this value. Azure Front Door origins, such as Web Apps, Blob Storage, and Cloud Services require this host header value to match the origin hostname by default. This overrides the host header defined at Endpoint."
+                                      }
+                                    },
+                                    "priority": {
+                                      "type": "int",
+                                      "defaultValue": 1,
+                                      "metadata": {
+                                        "description": "Optional. Priority of origin in given origin group for load balancing. Higher priorities will not be used for load balancing if any lower priority origin is healthy.Must be between 1 and 5."
+                                      }
+                                    },
+                                    "sharedPrivateLinkResource": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The properties of the private link resource for private origin."
+                                      }
+                                    },
+                                    "weight": {
+                                      "type": "int",
+                                      "defaultValue": 1000,
+                                      "metadata": {
+                                        "description": "Optional. Weight of the origin in given origin group for load balancing. Must be between 1 and 1000."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "profile::originGroup": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/originGroups",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), parameters('originGroupName'))]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "profile": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[parameters('profileName')]"
+                                    },
+                                    "origin": {
+                                      "type": "Microsoft.Cdn/profiles/originGroups/origins",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('profileName'), parameters('originGroupName'), parameters('name'))]",
+                                      "properties": {
+                                        "enabledState": "[parameters('enabledState')]",
+                                        "enforceCertificateNameCheck": "[parameters('enforceCertificateNameCheck')]",
+                                        "hostName": "[parameters('hostName')]",
+                                        "httpPort": "[parameters('httpPort')]",
+                                        "httpsPort": "[parameters('httpsPort')]",
+                                        "originHostHeader": "[parameters('originHostHeader')]",
+                                        "priority": "[parameters('priority')]",
+                                        "sharedPrivateLinkResource": "[parameters('sharedPrivateLinkResource')]",
+                                        "weight": "[parameters('weight')]"
+                                      },
+                                      "dependsOn": [
+                                        "profile::originGroup"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the origin."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource id of the origin."
+                                      },
+                                      "value": "[resourceId('Microsoft.Cdn/profiles/originGroups/origins', parameters('profileName'), parameters('originGroupName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the origin was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "originGroup"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the origin group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource id of the origin group."
+                              },
+                              "value": "[resourceId('Microsoft.Cdn/profiles/originGroups', parameters('profileName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the origin group was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('profile', '2023-05-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "profile"
+                      ]
+                    },
+                    "profile_ruleSets": {
+                      "copy": {
+                        "name": "profile_ruleSets",
+                        "count": "[length(parameters('ruleSets'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Profile-RuleSet-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('ruleSets')[copyIndex()].name]"
+                          },
+                          "profileName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "rules": {
+                            "value": "[parameters('ruleSets')[copyIndex()].rules]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "15489136897524188469"
+                            },
+                            "name": "CDN Profiles Rule Sets",
+                            "description": "This module deploys a CDN Profile rule set.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the rule set."
+                              }
+                            },
+                            "profileName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the CDN profile."
+                              }
+                            },
+                            "rules": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optinal. The rules to apply to the rule set."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "profile": {
+                              "existing": true,
+                              "type": "Microsoft.Cdn/profiles",
+                              "apiVersion": "2023-05-01",
+                              "name": "[parameters('profileName')]"
+                            },
+                            "ruleSet": {
+                              "type": "Microsoft.Cdn/profiles/ruleSets",
+                              "apiVersion": "2023-05-01",
+                              "name": "[format('{0}/{1}', parameters('profileName'), parameters('name'))]",
+                              "dependsOn": [
+                                "profile"
+                              ]
+                            },
+                            "ruleSet_rules": {
+                              "copy": {
+                                "name": "ruleSet_rules",
+                                "count": "[length(coalesce(parameters('rules'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-RuleSet-Rule-{1}-{2}', uniqueString(deployment().name), coalesce(parameters('rules'), createArray())[copyIndex()].name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "profileName": {
+                                    "value": "[parameters('profileName')]"
+                                  },
+                                  "ruleSetName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('rules'), createArray())[copyIndex()].name]"
+                                  },
+                                  "order": {
+                                    "value": "[coalesce(parameters('rules'), createArray())[copyIndex()].order]"
+                                  },
+                                  "actions": {
+                                    "value": "[tryGet(coalesce(parameters('rules'), createArray())[copyIndex()], 'actions')]"
+                                  },
+                                  "conditions": {
+                                    "value": "[tryGet(coalesce(parameters('rules'), createArray())[copyIndex()], 'conditions')]"
+                                  },
+                                  "matchProcessingBehavior": {
+                                    "value": "[tryGet(coalesce(parameters('rules'), createArray())[copyIndex()], 'matchProcessingBehavior')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "16996204249819398780"
+                                    },
+                                    "name": "CDN Profiles Rules",
+                                    "description": "This module deploys a CDN Profile rule.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the rule."
+                                      }
+                                    },
+                                    "profileName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the profile."
+                                      }
+                                    },
+                                    "ruleSetName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the rule set."
+                                      }
+                                    },
+                                    "order": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. The order in which this rule will be applied. Rules with a lower order are applied before rules with a higher order."
+                                      }
+                                    },
+                                    "actions": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A list of actions that are executed when all the conditions of a rule are satisfied."
+                                      }
+                                    },
+                                    "conditions": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A list of conditions that must be matched for the actions to be executed."
+                                      }
+                                    },
+                                    "matchProcessingBehavior": {
+                                      "type": "string",
+                                      "defaultValue": "Continue",
+                                      "allowedValues": [
+                                        "Continue",
+                                        "Stop"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. If this rule is a match should the rules engine continue running the remaining rules or stop. If not present, defaults to Continue."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "profile::ruleSet": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/ruleSets",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), parameters('ruleSetName'))]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "profile": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[parameters('profileName')]"
+                                    },
+                                    "rule": {
+                                      "type": "Microsoft.Cdn/profiles/ruleSets/rules",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('profileName'), parameters('ruleSetName'), parameters('name'))]",
+                                      "properties": {
+                                        "order": "[parameters('order')]",
+                                        "actions": "[parameters('actions')]",
+                                        "conditions": "[parameters('conditions')]",
+                                        "matchProcessingBehavior": "[parameters('matchProcessingBehavior')]"
+                                      },
+                                      "dependsOn": [
+                                        "profile::ruleSet"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource id of the rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.Cdn/profiles/ruleSets/rules', parameters('profileName'), parameters('ruleSetName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the custom domain was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the rule set."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource id of the rule set."
+                              },
+                              "value": "[resourceId('Microsoft.Cdn/profiles/ruleSets', parameters('profileName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the custom domain was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "profile"
+                      ]
+                    },
+                    "profile_afdEndpoints": {
+                      "copy": {
+                        "name": "profile_afdEndpoints",
+                        "count": "[length(parameters('afdEndpoints'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Profile-AfdEndpoint-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('afdEndpoints')[copyIndex()].name]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "profileName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "autoGeneratedDomainNameLabelScope": {
+                            "value": "[tryGet(parameters('afdEndpoints')[copyIndex()], 'autoGeneratedDomainNameLabelScope')]"
+                          },
+                          "enabledState": {
+                            "value": "[tryGet(parameters('afdEndpoints')[copyIndex()], 'enabledState')]"
+                          },
+                          "routes": {
+                            "value": "[tryGet(parameters('afdEndpoints')[copyIndex()], 'routes')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('afdEndpoints')[copyIndex()], 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "12280139305247236649"
+                            },
+                            "name": "CDN Profiles AFD Endpoints",
+                            "description": "This module deploys a CDN Profile AFD Endpoint.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the AFD Endpoint."
+                              }
+                            },
+                            "profileName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent CDN profile. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location of the AFD Endpoint."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The tags of the AFD Endpoint."
+                              }
+                            },
+                            "autoGeneratedDomainNameLabelScope": {
+                              "type": "string",
+                              "defaultValue": "TenantReuse",
+                              "allowedValues": [
+                                "NoReuse",
+                                "ResourceGroupReuse",
+                                "SubscriptionReuse",
+                                "TenantReuse"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Indicates the endpoint name reuse scope. The default value is TenantReuse."
+                              }
+                            },
+                            "enabledState": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Indicates whether the AFD Endpoint is enabled. The default value is Enabled."
+                              }
+                            },
+                            "routes": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of routes for this AFD Endpoint."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "profile": {
+                              "existing": true,
+                              "type": "Microsoft.Cdn/profiles",
+                              "apiVersion": "2023-05-01",
+                              "name": "[parameters('profileName')]"
+                            },
+                            "afdEndpoint": {
+                              "type": "Microsoft.Cdn/profiles/afdEndpoints",
+                              "apiVersion": "2023-05-01",
+                              "name": "[format('{0}/{1}', parameters('profileName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                "enabledState": "[parameters('enabledState')]"
+                              },
+                              "dependsOn": [
+                                "profile"
+                              ]
+                            },
+                            "afdEndpoint_routes": {
+                              "copy": {
+                                "name": "afdEndpoint_routes",
+                                "count": "[length(coalesce(parameters('routes'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Profile-AfdEndpoint-Route', uniqueString(deployment().name, coalesce(parameters('routes'), createArray())[copyIndex()].name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('routes'), createArray())[copyIndex()].name]"
+                                  },
+                                  "profileName": {
+                                    "value": "[parameters('profileName')]"
+                                  },
+                                  "afdEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "cacheConfiguration": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'cacheConfiguration')]"
+                                  },
+                                  "customDomainNames": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'customDomainNames')]"
+                                  },
+                                  "enabledState": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'enabledState')]"
+                                  },
+                                  "forwardingProtocol": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'forwardingProtocol')]"
+                                  },
+                                  "httpsRedirect": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'httpsRedirect')]"
+                                  },
+                                  "linkToDefaultDomain": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'linkToDefaultDomain')]"
+                                  },
+                                  "originGroupName": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'originGroupName')]"
+                                  },
+                                  "originPath": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'originPath')]"
+                                  },
+                                  "patternsToMatch": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'patternsToMatch')]"
+                                  },
+                                  "ruleSets": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'ruleSets')]"
+                                  },
+                                  "supportedProtocols": {
+                                    "value": "[tryGet(coalesce(parameters('routes'), createArray())[copyIndex()], 'supportedProtocols')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.27.1.19265",
+                                      "templateHash": "10229922284695085147"
+                                    },
+                                    "name": "CDN Profiles AFD Endpoint Route",
+                                    "description": "This module deploys a CDN Profile AFD Endpoint route.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the route."
+                                      }
+                                    },
+                                    "profileName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent CDN profile."
+                                      }
+                                    },
+                                    "afdEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the AFD endpoint."
+                                      }
+                                    },
+                                    "cacheConfiguration": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The caching configuration for this route. To disable caching, do not provide a cacheConfiguration object."
+                                      }
+                                    },
+                                    "customDomainNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The names of the custom domains. The custom domains must be defined in the profile customDomains array."
+                                      }
+                                    },
+                                    "forwardingProtocol": {
+                                      "type": "string",
+                                      "defaultValue": "MatchRequest",
+                                      "allowedValues": [
+                                        "HttpOnly",
+                                        "HttpsOnly",
+                                        "MatchRequest"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The protocol this rule will use when forwarding traffic to backends."
+                                      }
+                                    },
+                                    "enabledState": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether this route is enabled."
+                                      }
+                                    },
+                                    "httpsRedirect": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether to automatically redirect HTTP traffic to HTTPS traffic."
+                                      }
+                                    },
+                                    "linkToDefaultDomain": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether this route will be linked to the default endpoint domain."
+                                      }
+                                    },
+                                    "originGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the origin group. The origin group must be defined in the profile originGroups."
+                                      }
+                                    },
+                                    "originPath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A directory path on the origin that AzureFrontDoor can use to retrieve content from, e.g. contoso.cloudapp.net/originpath."
+                                      }
+                                    },
+                                    "patternsToMatch": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The route patterns of the rule."
+                                      }
+                                    },
+                                    "ruleSets": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The rule sets of the rule. The rule sets must be defined in the profile ruleSets."
+                                      }
+                                    },
+                                    "supportedProtocols": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Http",
+                                        "Https"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The supported protocols of the rule."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "profile::afdEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/afdEndpoints",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), parameters('afdEndpointName'))]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "profile::customDomains": {
+                                      "copy": {
+                                        "name": "customDomains",
+                                        "count": "[length(coalesce(parameters('customDomainNames'), createArray()))]"
+                                      },
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/customDomains",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), coalesce(parameters('customDomainNames'), createArray())[copyIndex()])]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "profile::originGroup": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/originGroups",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), parameters('originGroupName'))]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "profile::ruleSet": {
+                                      "copy": {
+                                        "name": "ruleSet",
+                                        "count": "[length(parameters('ruleSets'))]"
+                                      },
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles/ruleSets",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}', parameters('profileName'), parameters('ruleSets')[copyIndex()].name)]",
+                                      "dependsOn": [
+                                        "profile"
+                                      ]
+                                    },
+                                    "profile": {
+                                      "existing": true,
+                                      "type": "Microsoft.Cdn/profiles",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[parameters('profileName')]"
+                                    },
+                                    "route": {
+                                      "type": "Microsoft.Cdn/profiles/afdEndpoints/routes",
+                                      "apiVersion": "2023-05-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('profileName'), parameters('afdEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "customDomains",
+                                            "count": "[length(range(0, length(coalesce(parameters('customDomainNames'), createArray()))))]",
+                                            "input": {
+                                              "id": "[resourceId('Microsoft.Cdn/profiles/customDomains', parameters('profileName'), coalesce(parameters('customDomainNames'), createArray())[range(0, length(coalesce(parameters('customDomainNames'), createArray())))[copyIndex('customDomains')]])]"
+                                            }
+                                          },
+                                          {
+                                            "name": "ruleSets",
+                                            "count": "[length(parameters('ruleSets'))]",
+                                            "input": {
+                                              "id": "[resourceId('Microsoft.Cdn/profiles/ruleSets', parameters('profileName'), parameters('ruleSets')[copyIndex('ruleSets')].name)]"
+                                            }
+                                          }
+                                        ],
+                                        "cacheConfiguration": "[parameters('cacheConfiguration')]",
+                                        "enabledState": "[parameters('enabledState')]",
+                                        "forwardingProtocol": "[parameters('forwardingProtocol')]",
+                                        "httpsRedirect": "[parameters('httpsRedirect')]",
+                                        "linkToDefaultDomain": "[parameters('linkToDefaultDomain')]",
+                                        "originGroup": {
+                                          "id": "[resourceId('Microsoft.Cdn/profiles/originGroups', parameters('profileName'), parameters('originGroupName'))]"
+                                        },
+                                        "originPath": "[parameters('originPath')]",
+                                        "patternsToMatch": "[parameters('patternsToMatch')]",
+                                        "supportedProtocols": "[parameters('supportedProtocols')]"
+                                      },
+                                      "dependsOn": [
+                                        "profile::afdEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the route."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The ID of the route."
+                                      },
+                                      "value": "[resourceId('Microsoft.Cdn/profiles/afdEndpoints/routes', parameters('profileName'), parameters('afdEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the route was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "afdEndpoint",
+                                "profile"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the AFD Endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource id of the AFD Endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Cdn/profiles/afdEndpoints', parameters('profileName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the endpoint was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('afdEndpoint', '2023-05-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "profile",
+                        "profile_customDomains",
+                        "profile_originGroups",
+                        "profile_ruleSets"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the CDN profile."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the CDN profile."
+                      },
+                      "value": "[resourceId('Microsoft.Cdn/profiles', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group where the CDN profile is deployed."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "profileType": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The type of the CDN profile."
+                      },
+                      "value": "Microsoft.Cdn/profiles"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('profile', '2023-05-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', format('privateLinkServiceFrontDoorDeployment-{0}', uniqueString(resourceGroup().id)))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "frontDoorResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The ID of the front door resource."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('frontDoorDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.resourceId.value]"
+            },
+            "privateLinkServiceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The ID of the private link service."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('privateLinkServiceFrontDoorDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.privateLinkServiceId.value]"
+            },
+            "privateLinkEndpointConnectionId": {
+              "type": "string",
+              "metadata": {
+                "description": "The ID of the private link endpoint connection to approve."
+              },
+              "value": "[if(greater(length(reference(resourceId('Microsoft.Resources/deployments', format('privateLinkServiceFrontDoorDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.privateEndpointConnections.value), 0), filter(reference(resourceId('Microsoft.Resources/deployments', format('privateLinkServiceFrontDoorDeployment-{0}', uniqueString(resourceGroup().id))), '2022-09-01').outputs.privateEndpointConnections.value, lambda('connection', equals(lambdaVariables('connection').properties.privateLinkServiceConnectionState.description, 'frontdoor')))[0].id, '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('sampleApplication-{0}-deployment', deployment().name), 64))]",
+        "[subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64))]"
+      ]
+    }
+  ],
+  "outputs": {
+    "spokeResourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Spoke resource group."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeResourceGroupName.value]"
+    },
+    "spokeVNetResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The  resource ID of the Spoke Virtual Network."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeVNetId.value]"
+    },
+    "spokeVnetName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Spoke Virtual Network."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeVNetName.value]"
+    },
+    "spokeInfraSubnetResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Spoke Infrastructure Subnet."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeInfraSubnetId.value]"
+    },
+    "spokeInfraSubnetName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Spoke Infrastructure Subnet."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeInfraSubnetName.value]"
+    },
+    "spokePrivateEndpointsSubnetName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Spoke Private Endpoints Subnet."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokePrivateEndpointsSubnetName.value]"
+    },
+    "spokeApplicationGatewaySubnetResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Spoke Application Gateway Subnet. If \"spokeApplicationGatewaySubnetAddressPrefix\" is empty, the subnet will not be created and the value returned is empty."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeApplicationGatewaySubnetId.value]"
+    },
+    "spokeApplicationGatewaySubnetName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Spoke Application Gateway Subnet.  If \"spokeApplicationGatewaySubnetAddressPrefix\" is empty, the subnet will not be created and the value returned is empty."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.spokeApplicationGatewaySubnetName.value]"
+    },
+    "logAnalyticsWorkspaceResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Log Analytics workspace created in the spoke vnet."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.logAnalyticsWorkspaceId.value]"
+    },
+    "vmJumpBoxName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the jump box virtual machine."
+      },
+      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', take(format('spoke-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.vmJumpBoxName.value]"
+    },
+    "containerRegistryResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the container registry."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerRegistryId.value]"
+    },
+    "containerRegistryName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the container registry."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerRegistryName.value]"
+    },
+    "containerRegistryLoginServer": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the container registry login server."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerRegistryLoginServer.value]"
+    },
+    "containerRegistryUserAssignedIdentityResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the user assigned managed identity for the container registry to be able to pull images from it."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerRegistryUserAssignedIdentityId.value]"
+    },
+    "keyVaultResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the key vault."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.keyVaultResourceId.value]"
+    },
+    "keyVaultName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Azure key vault."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('supportingServices-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.keyVaultName.value]"
+    },
+    "applicationGatewayResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Azure Application Gateway."
+      },
+      "value": "[if(equals(parameters('exposeContainerAppsWith'), 'applicationGateway'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('applicationGateway-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.applicationGatewayResourceId.value, '')]"
+    },
+    "applicationGatewayFqdn": {
+      "type": "string",
+      "metadata": {
+        "description": "The FQDN of the Azure Application Gateway."
+      },
+      "value": "[if(equals(parameters('exposeContainerAppsWith'), 'applicationGateway'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('applicationGateway-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.applicationGatewayFqdn.value, '')]"
+    },
+    "applicationGatewayPublicIp": {
+      "type": "string",
+      "metadata": {
+        "description": "The public IP address of the Azure Application Gateway."
+      },
+      "value": "[if(equals(parameters('exposeContainerAppsWith'), 'applicationGateway'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('applicationGateway-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.applicationGatewayPublicIp.value, '')]"
+    },
+    "containerAppsEnvironmentResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the container apps environment."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerAppsEnvironmentId.value]"
+    },
+    "containerAppsEnvironmentName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the container apps environment."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.containerAppsEnvironmentName.value]"
+    },
+    "applicationInsightsName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of application Insights instance."
+      },
+      "value": "[if(parameters('enableApplicationInsights'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('rgSpokeName')), 'Microsoft.Resources/deployments', take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)), '2022-09-01').outputs.applicationInsightsName.value, '')]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/application-gateway/app-gateway-cert.bicep b/avm/ptn/aca-lza/hosting-environment/modules/application-gateway/app-gateway-cert.bicep
new file mode 100644
index 0000000000..b411ca2bbd
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/application-gateway/app-gateway-cert.bicep
@@ -0,0 +1,53 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+param keyVaultName string
+
+param appGatewayUserAssignedIdentityPrincipalId string
+
+param appGatewayCertificateKeyName string
+
+param appGatewayCertificateData string
+
+// ------------------
+// VARIABLES
+// ------------------
+
+var keyVaultSecretUserRoleGuid = '4633458b-17de-408a-b874-0445c86b69e6'
+
+// ------------------
+// RESOURCES
+// ------------------
+
+resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
+  name: keyVaultName
+}
+
+//TODO: this needs to be updated to use the AVM module when it is available
+resource sslCertSecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
+  parent: keyVault
+  name: appGatewayCertificateKeyName
+  properties: {
+    value: appGatewayCertificateData
+    contentType: 'application/x-pkcs12'
+    attributes: {
+      enabled: true
+    }
+  }
+}
+
+resource keyvaultSecretUserRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(subscription().id, keyVault.id, appGatewayUserAssignedIdentityPrincipalId, 'KeyVaultSecretUser')
+  scope: sslCertSecret
+  properties: {
+    principalId: appGatewayUserAssignedIdentityPrincipalId
+    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', keyVaultSecretUserRoleGuid)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Using SecretUri instead of SecretUriWithVersion to avoid having to update the App Gateway configuration when the secret version changes
+output SecretUri string = sslCertSecret.properties.secretUri
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/application-gateway/deploy.app-gateway.bicep b/avm/ptn/aca-lza/hosting-environment/modules/application-gateway/deploy.app-gateway.bicep
new file mode 100644
index 0000000000..54726eed7f
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/application-gateway/deploy.app-gateway.bicep
@@ -0,0 +1,402 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+@description('The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long.')
+@maxLength(8)
+param environment string
+
+@description('The location where the resources will be created. This needs to be the same region as the spoke.')
+param location string = resourceGroup().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Defines whether to enable telemetry for the modules deployment.')
+param enableTelemetry bool
+
+@description('The FQDN of the Application Gateawy. Must match the TLS certificate.')
+param applicationGatewayFqdn string
+
+@description('The existing subnet resource ID to use for Application Gateway.')
+param applicationGatewaySubnetId string
+
+@description('The FQDN of the primary backend endpoint.')
+param applicationGatewayPrimaryBackendEndFqdn string
+
+@description('The path to use for Application Gateway\'s backend health probe.')
+param appGatewayBackendHealthProbePath string = '/'
+
+@description('The base64 encoded certificate to use for Application Gateway certificate. If this is provided, the certificate will be added to the Key Vault.')
+@secure()
+param base64Certificate string = ''
+
+@description('The name of the certificate key to use for Application Gateway certificate.')
+param applicationGatewayCertificateKeyName string
+
+@description('The resource ID of the exsiting Log Analytics workload for diagnostic settngs, or nothing if you don\'t need any.')
+param applicationGatewayLogAnalyticsId string = ''
+
+@description('The resource ID of the existing Key Vault which contains Application Gateway\'s cert.')
+param keyVaultId string
+
+@description('Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false.')
+param deployZoneRedundantResources bool = true
+
+@description('Optional. DDoS protection mode for the Public IP of the Application Gateway. See https://learn.microsoft.com/azure/ddos-protection/ddos-protection-sku-comparison#skus')
+param enableDdosProtection bool = false
+
+// ------------------
+// VARIABLES
+// ------------------
+
+var keyVaultIdTokens = split(keyVaultId, '/')
+
+@description('The subscription ID of the existing Key Vault.')
+var keyVaultSubscriptionId = keyVaultIdTokens[2]
+
+@description('The name of the resource group containing the existing Key Vault.')
+var keyVaultResourceGroupName = keyVaultIdTokens[4]
+
+@description('The name of the existing Key Vault.')
+var keyVaultName = keyVaultIdTokens[8]
+
+// ------------------
+// RESOURCES
+// ------------------
+
+@description('User-configured naming rules')
+module naming '../naming/naming.module.bicep' = {
+  name: take('agwNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(resourceGroup().id)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+// TODO: Check if this is required if enableApplicationCertificate is false
+@description('A user-assigned managed identity that enables Application Gateway to access Key Vault for its TLS certs.')
+module userAssignedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.2.1' = {
+  name: take('appGwUserAssignedIdentity-Deployment-${uniqueString(resourceGroup().id)}', 64)
+
+  params: {
+    name: naming.outputs.resourcesNames.applicationGatewayUserAssignedIdentity
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+// => Key Vault User Assigned Identity, Secret & Role Assignement for certificate
+// As of today, App Gateway does not supports  "System Managed Identity" for Key Vault
+// https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#key-vault-secrets-user
+
+// => Certificates (supports only 1 for now)
+
+// @description('Adds the PFX file into Azure Key Vault for consumption by Application Gateway.')
+module appGatewayAddCertificates 'app-gateway-cert.bicep' = if (!empty(base64Certificate)) {
+  name: take('appGatewayAddCertificates-Deployment-${uniqueString(resourceGroup().id)}', 64)
+  scope: resourceGroup(keyVaultSubscriptionId, keyVaultResourceGroupName)
+  params: {
+    keyVaultName: keyVaultName
+    appGatewayCertificateData: base64Certificate
+    appGatewayCertificateKeyName: applicationGatewayCertificateKeyName
+    appGatewayUserAssignedIdentityPrincipalId: userAssignedIdentity.outputs.principalId
+  }
+}
+
+module applicationGatewayPublicIp 'br/public:avm/res/network/public-ip-address:0.4.1' = {
+  name: take('applicationGatewayPublicIp-Deployment-${uniqueString(resourceGroup().id)}', 64)
+  params: {
+    location: location
+    name: naming.outputs.resourcesNames.applicationGatewayPip
+    tags: tags
+    enableTelemetry: enableTelemetry
+    skuName: 'Standard'
+    publicIPAllocationMethod: 'Static'
+    ddosSettings: enableDdosProtection
+      ? {
+          protectionMode: 'Enabled'
+        }
+      : null
+    zones: (deployZoneRedundantResources)
+      ? [
+          1
+          2
+          3
+        ]
+      : []
+    diagnosticSettings: [
+      {
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+          }
+        ]
+        name: 'publicIpDiagnosticSettings'
+        workspaceResourceId: applicationGatewayLogAnalyticsId
+      }
+    ]
+  }
+}
+
+@description('The Application Gateway.')
+module applicationGateway 'br/public:avm/res/network/application-gateway:0.1.0' = {
+  name: take('applicationGateway-Deployment-${uniqueString(resourceGroup().id)}', 64)
+  params: {
+    // Required parameters
+    name: naming.outputs.resourcesNames.applicationGateway
+    enableTelemetry: enableTelemetry
+    // Non-required parameters
+    backendAddressPools: [
+      {
+        name: 'acaServiceBackend'
+        properties: {
+          backendAddresses: (!empty(applicationGatewayPrimaryBackendEndFqdn))
+            ? [
+                {
+                  fqdn: applicationGatewayPrimaryBackendEndFqdn
+                }
+              ]
+            : null
+        }
+      }
+    ]
+    backendHttpSettingsCollection: [
+      {
+        name: 'https'
+        properties: {
+          port: 443
+          protocol: 'Https'
+          cookieBasedAffinity: 'Disabled'
+          pickHostNameFromBackendAddress: true
+          requestTimeout: 20
+          probe: (!empty(applicationGatewayPrimaryBackendEndFqdn))
+            ? {
+                id: resourceId(
+                  'Microsoft.Network/applicationGateways/probes',
+                  naming.outputs.resourcesNames.applicationGateway,
+                  'webProbe'
+                )
+              }
+            : null
+        }
+      }
+    ]
+    diagnosticSettings: [
+      {
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+          }
+        ]
+        name: 'customSetting'
+        workspaceResourceId: applicationGatewayLogAnalyticsId
+      }
+    ]
+    enableHttp2: true
+    frontendIPConfigurations: [
+      {
+        name: 'appGwPublicFrontendIp'
+        properties: {
+          privateIPAllocationMethod: 'Dynamic'
+          publicIPAddress: {
+            id: applicationGatewayPublicIp.outputs.resourceId
+          }
+        }
+      }
+    ]
+    frontendPorts: (!empty(base64Certificate))
+      ? [
+          {
+            name: 'port_443'
+            properties: {
+              port: 443
+            }
+          }
+          {
+            name: 'port_80'
+            properties: {
+              port: 80
+            }
+          }
+        ]
+      : [
+          {
+            name: 'port_80'
+            properties: {
+              port: 80
+            }
+          }
+        ]
+    gatewayIPConfigurations: [
+      {
+        name: 'appGatewayIpConfig'
+        properties: {
+          subnet: {
+            id: applicationGatewaySubnetId
+          }
+        }
+      }
+    ]
+    httpListeners: (empty(base64Certificate))
+      ? [
+          {
+            name: 'httpListener'
+            properties: {
+              frontendIPConfiguration: {
+                #disable-next-line use-resource-id-functions
+                id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/frontendIPConfigurations/appGwPublicFrontendIp'
+              }
+              frontendPort: {
+                #disable-next-line use-resource-id-functions
+                id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/frontendPorts/port_80'
+              }
+              protocol: 'Http'
+              hostnames: []
+              requireServerNameIndication: false
+            }
+          }
+        ]
+      : [
+          {
+            name: 'httpsListener'
+            properties: {
+              frontendIPConfiguration: {
+                #disable-next-line use-resource-id-functions
+                id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/frontendIPConfigurations/appGwPublicFrontendIp'
+              }
+              frontendPort: {
+                #disable-next-line use-resource-id-functions
+                id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/frontendPorts/port_443'
+              }
+              protocol: 'Https'
+              sslCertificate: {
+                #disable-next-line use-resource-id-functions
+                id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/sslCertificates/${applicationGatewayFqdn}'
+              }
+              hostnames: []
+              requireServerNameIndication: false
+            }
+          }
+        ]
+    location: location
+    managedIdentities: {
+      userAssignedResourceIds: [
+        userAssignedIdentity.outputs.resourceId
+      ]
+    }
+    probes: (!empty(applicationGatewayPrimaryBackendEndFqdn))
+      ? [
+          {
+            name: 'webProbe'
+            properties: {
+              protocol: 'Https'
+              host: applicationGatewayPrimaryBackendEndFqdn
+              path: appGatewayBackendHealthProbePath
+              interval: 30
+              timeout: 30
+              unhealthyThreshold: 3
+              pickHostNameFromBackendHttpSettings: false
+              minServers: 0
+              match: {
+                statusCodes: [
+                  '200-499'
+                ]
+              }
+            }
+          }
+        ]
+      : null
+    requestRoutingRules: [
+      {
+        name: 'routingRules'
+        properties: {
+          ruleType: 'Basic'
+          priority: 100
+          httpListener: {
+            #disable-next-line use-resource-id-functions
+            id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/httpListeners/httpListener'
+          }
+          backendAddressPool: {
+            #disable-next-line use-resource-id-functions
+            id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/backendAddressPools/acaServiceBackend'
+          }
+          backendHttpSettings: {
+            #disable-next-line use-resource-id-functions
+            id: '${resourceId('Microsoft.Network/applicationGateways', naming.outputs.resourcesNames.applicationGateway)}/backendHttpSettingsCollection/https'
+          }
+        }
+      }
+    ]
+    sku: 'WAF_v2'
+    sslCertificates: (!empty(base64Certificate))
+      ? [
+          {
+            name: applicationGatewayFqdn
+            properties: {
+              keyVaultSecretId: appGatewayAddCertificates.outputs.SecretUri
+            }
+          }
+        ]
+      : []
+    tags: tags
+    firewallPolicyId: appGwWafPolicy.outputs.resourceId
+    sslPolicyType: 'Predefined'
+    sslPolicyName: 'AppGwSslPolicy20220101'
+    zones: [
+      '1'
+      '2'
+      '3'
+    ]
+  }
+}
+
+module appGwWafPolicy 'br/public:avm/res/network/application-gateway-web-application-firewall-policy:0.1.0' = {
+  name: take('appGwWafPolicy-Deployment-${uniqueString(resourceGroup().id)}', 64)
+  params: {
+    name: '${naming.outputs.resourcesNames.applicationGateway}Policy001'
+    location: location
+    enableTelemetry: enableTelemetry
+    policySettings: {
+      fileUploadLimitInMb: 10
+      state: 'Enabled'
+      mode: 'Prevention'
+    }
+    managedRules: {
+      managedRuleSets: [
+        {
+          ruleSetType: 'OWASP'
+          ruleSetVersion: '3.2'
+          ruleGroupOverrides: []
+        }
+        {
+          ruleSetType: 'Microsoft_BotManagerRuleSet'
+          ruleSetVersion: '0.1'
+        }
+      ]
+    }
+    tags: tags
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The resource ID of the Azure Application Gateway.')
+output applicationGatewayResourceId string = applicationGateway.outputs.resourceId
+
+@description('The FQDN of the Azure Application Gateway.')
+output applicationGatewayFqdn string = applicationGatewayFqdn
+
+@description('The public IP address of the Azure Application Gateway.')
+output applicationGatewayPublicIp string = applicationGatewayPublicIp.outputs.ipAddress
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/compute/linux-vm.bicep b/avm/ptn/aca-lza/hosting-environment/modules/compute/linux-vm.bicep
new file mode 100644
index 0000000000..0446870dea
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/compute/linux-vm.bicep
@@ -0,0 +1,175 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+param vmName string
+param vmSize string
+param storageAccountType string = 'Standard_LRS'
+param vmZone int = 0
+param vmVnetName string
+param vmSubnetName string
+param vmSubnetAddressPrefix string
+param vmNetworkSecurityGroupName string
+param vmNetworkInterfaceName string
+param logAnalyticsWorkspaceResourceId string
+param bastionResourceId string
+param vmAdminUsername string
+
+@secure()
+param vmAdminPassword string
+
+@secure()
+param vmSshPublicKey string
+
+@description('Type of authentication to use on the Virtual Machine. SSH key is recommended.')
+@allowed([
+  'sshPublicKey'
+  'password'
+])
+param vmAuthenticationType string = 'password'
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+param location string = resourceGroup().location
+
+// ------------------
+// VARIABLES
+// ------------------
+
+// ------------------
+// RESOURCES
+// ------------------
+
+module vmNetworkSecurityGroup 'br/public:avm/res/network/network-security-group:0.2.0' = {
+  name: 'vmNetworkSecurityDeployment'
+  params: {
+    name: vmNetworkSecurityGroupName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    securityRules: !empty(bastionResourceId)
+      ? [
+          {
+            name: 'allow-bastion-inbound'
+            properties: {
+              description: 'Allow inbound traffic from Bastion to the JumpBox'
+              protocol: '*'
+              sourceAddressPrefix: 'Bastion'
+              sourcePortRange: '*'
+              destinationAddressPrefix: '*'
+              destinationPortRange: '*'
+              access: 'Allow'
+              priority: 100
+              direction: 'Inbound'
+            }
+          }
+        ]
+      : []
+  }
+}
+
+//TODO: Subnet deployment needs to be updated with AVM module once it is available
+resource vmSubnet 'Microsoft.Network/virtualNetworks/subnets@2023-11-01' = {
+  name: '${vmVnetName}/${vmSubnetName}'
+  properties: {
+    addressPrefix: vmSubnetAddressPrefix
+    networkSecurityGroup: {
+      id: vmNetworkSecurityGroup.outputs.resourceId
+    }
+  }
+}
+resource maintenanceConfiguration 'Microsoft.Maintenance/maintenanceConfigurations@2023-10-01-preview' = {
+  name: 'dep-mc-${vmName}'
+  location: location
+  properties: {
+    extensionProperties: {
+      InGuestPatchMode: 'User'
+    }
+    maintenanceScope: 'InGuestPatch'
+    maintenanceWindow: {
+      startDateTime: '2024-06-16 00:00'
+      duration: '03:55'
+      timeZone: 'W. Europe Standard Time'
+      recurEvery: '1Day'
+    }
+    visibility: 'Custom'
+    installPatches: {
+      rebootSetting: 'IfRequired'
+      linuxParameters: {
+        classificationsToInclude: [
+          'Critical'
+          'Security'
+        ]
+      }
+    }
+  }
+}
+
+module vm 'br/public:avm/res/compute/virtual-machine:0.5.1' = {
+  name: 'vmDeployment'
+  params: {
+    name: vmName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    osType: 'Linux'
+    computerName: vmName
+    adminUsername: vmAdminUsername
+    adminPassword: ((vmAuthenticationType == 'password') ? vmAdminPassword : null)
+    disablePasswordAuthentication: ((vmAuthenticationType == 'password') ? false : true)
+    encryptionAtHost: false
+    enableAutomaticUpdates: true
+    patchMode: 'AutomaticByPlatform'
+    bypassPlatformSafetyChecksOnUserSchedule: true
+    maintenanceConfigurationResourceId: maintenanceConfiguration.id
+    publicKeys: ((vmAuthenticationType == 'sshPublicKey')
+      ? [
+          {
+            keyData: vmSshPublicKey
+            path: '/home/${vmAdminUsername}/.ssh/authorized_keys'
+          }
+        ]
+      : [])
+    nicConfigurations: [
+      {
+        name: vmNetworkInterfaceName
+        enableAcceleratedNetworking: false
+        ipConfigurations: [
+          {
+            name: 'ipConfig01'
+            privateIPAllocationMethod: 'Dynamic'
+            subnetResourceId: vmSubnet.id
+          }
+        ]
+      }
+    ]
+    osDisk: {
+      caching: 'ReadWrite'
+      createOption: 'FromImage'
+      deleteOption: 'Delete'
+      diskSizeGB: 128
+      managedDisk: {
+        storageAccountType: storageAccountType
+      }
+    }
+    zone: vmZone
+    vmSize: vmSize
+    imageReference: {
+      publisher: 'canonical'
+      offer: '0001-com-ubuntu-server-focal'
+      sku: '20_04-lts-gen2'
+      version: 'latest'
+    }
+    extensionMonitoringAgentConfig: {
+      enabled: true
+      tags: tags
+      monitoringWorkspaceResourceId: logAnalyticsWorkspaceResourceId
+    }
+  }
+}
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/compute/windows-vm.bicep b/avm/ptn/aca-lza/hosting-environment/modules/compute/windows-vm.bicep
new file mode 100644
index 0000000000..166e668904
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/compute/windows-vm.bicep
@@ -0,0 +1,158 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+param vmName string
+param vmSize string
+param storageAccountType string = 'Standard_LRS'
+param vmWindowsOSVersion string = '2016-Datacenter'
+param vmZone int = 0
+param vmVnetName string
+param vmSubnetName string
+param vmSubnetAddressPrefix string
+param vmNetworkSecurityGroupName string
+param vmNetworkInterfaceName string
+param logAnalyticsWorkspaceResourceId string
+param bastionResourceId string
+param vmAdminUsername string
+
+@secure()
+param vmAdminPassword string
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+param location string = resourceGroup().location
+
+// ------------------
+// VARIABLES
+// ------------------
+
+// ------------------
+// RESOURCES
+// ------------------
+
+module vmNetworkSecurityGroup 'br/public:avm/res/network/network-security-group:0.2.0' = {
+  name: 'vmNetworkSecurityDeployment'
+  params: {
+    name: vmNetworkSecurityGroupName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    securityRules: !empty(bastionResourceId)
+      ? [
+          {
+            name: 'allow-bastion-inbound'
+            properties: {
+              description: 'Allow inbound traffic from Bastion to the JumpBox'
+              protocol: '*'
+              sourceAddressPrefix: 'Bastion'
+              sourcePortRange: '*'
+              destinationAddressPrefix: '*'
+              destinationPortRange: '*'
+              access: 'Allow'
+              priority: 100
+              direction: 'Inbound'
+            }
+          }
+        ]
+      : []
+  }
+}
+
+//TODO: Subnet deployment needs to be updated with AVM module once it is available
+resource vmSubnet 'Microsoft.Network/virtualNetworks/subnets@2023-11-01' = {
+  name: '${vmVnetName}/${vmSubnetName}'
+  properties: {
+    addressPrefix: vmSubnetAddressPrefix
+    networkSecurityGroup: {
+      id: vmNetworkSecurityGroup.outputs.resourceId
+    }
+  }
+}
+
+resource maintenanceConfiguration 'Microsoft.Maintenance/maintenanceConfigurations@2023-10-01-preview' = {
+  name: 'dep-mc-${vmName}'
+  location: location
+  properties: {
+    extensionProperties: {
+      InGuestPatchMode: 'User'
+    }
+    maintenanceScope: 'InGuestPatch'
+    maintenanceWindow: {
+      startDateTime: '2024-06-16 00:00'
+      duration: '03:55'
+      timeZone: 'W. Europe Standard Time'
+      recurEvery: '1Day'
+    }
+    visibility: 'Custom'
+    installPatches: {
+      rebootSetting: 'IfRequired'
+      windowsParameters: {
+        classificationsToInclude: [
+          'Critical'
+          'Security'
+        ]
+      }
+    }
+  }
+}
+
+module vm 'br/public:avm/res/compute/virtual-machine:0.5.1' = {
+  name: 'vmDeployment'
+  params: {
+    name: vmName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    osType: 'Windows'
+    computerName: vmName
+    adminUsername: vmAdminUsername
+    adminPassword: vmAdminPassword
+    encryptionAtHost: false
+    enableAutomaticUpdates: true
+    patchMode: 'AutomaticByPlatform'
+    bypassPlatformSafetyChecksOnUserSchedule: true
+    maintenanceConfigurationResourceId: maintenanceConfiguration.id
+    nicConfigurations: [
+      {
+        name: vmNetworkInterfaceName
+        enableAcceleratedNetworking: false
+        ipConfigurations: [
+          {
+            name: 'ipconfig1'
+            privateIPAllocationMethod: 'Dynamic'
+            subnetResourceId: vmSubnet.id
+          }
+        ]
+      }
+    ]
+    osDisk: {
+      caching: 'ReadWrite'
+      createOption: 'FromImage'
+      deleteOption: 'Delete'
+      diskSizeGB: 128
+      managedDisk: {
+        storageAccountType: storageAccountType
+      }
+    }
+    zone: vmZone
+    vmSize: vmSize
+    imageReference: {
+      publisher: 'MicrosoftWindowsServer'
+      offer: 'WindowsServer'
+      sku: vmWindowsOSVersion
+      version: 'latest'
+    }
+    extensionMonitoringAgentConfig: {
+      enabled: true
+      tags: tags
+      monitoringWorkspaceResourceId: logAnalyticsWorkspaceResourceId
+    }
+  }
+}
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/container-apps-environment/README.md b/avm/ptn/aca-lza/hosting-environment/modules/container-apps-environment/README.md
new file mode 100644
index 0000000000..27ece2b8c3
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/container-apps-environment/README.md
@@ -0,0 +1,57 @@
+# Deploy the Azure Container Apps Environment
+
+With your spoke virtual network in place and the services that Azure Containers Apps needs in this architecture in place, you're ready to deploy the application platform.
+
+## Expected results
+
+The application platform, Azure Containers Apps, and its logging sinks within Azure Monitor will now be deployed. The workload is not deployed as part of step. Non-mission critical workload lifecycles are usually not tied to the lifecycle of the application platform, and as such are deployed isolated from infrastructure deployments, such as this one. Some cross-cutting concerns and platform feature enablement is usually handled however at this stage.
+
+![A picture of the resources of this architecture, now with the application platform.](./media/container-apps-environment.png)
+
+### Resources
+
+- Container Apps Environment Environment
+- Log Analytics Workspace
+- Application Insights (optional)
+- Dapr Telemetry with Application Insights (optional)
+- Private DNS Zone for Container Apps Environment
+
+## Steps
+
+1. Create the Azure Container Apps application platform resources.
+
+   ```bash
+   RESOURCEID_VNET_HUB=$(az deployment sub show -n acalza01-hub --query properties.outputs.hubVNetId.value -o tsv)
+   RESOURCENAME_RESOURCEGROUP_SPOKE=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.spokeResourceGroupName.value -o tsv)
+   RESOURCENAME_VNET_SPOKE=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.spokeVNetName.value -o tsv)
+   LOG_ANALYTICS_WS_ID=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.logAnalyticsWorkspaceId.value -o tsv)
+
+   echo RESOURCEID_VNET_HUB: $RESOURCEID_VNET_HUB && \
+   echo RESOURCENAME_RESOURCEGROUP_SPOKE: $RESOURCENAME_RESOURCEGROUP_SPOKE && \
+   echo RESOURCENAME_VNET_SPOKE: $RESOURCENAME_VNET_SPOKE && \
+   echo LOG_ANALYTICS_WS_ID: $LOG_ANALYTICS_WS_ID
+
+   # [This takes about 11 minutes to run.]
+   az deployment group create \
+      -n acalza01-appplat \
+      -g $RESOURCENAME_RESOURCEGROUP_SPOKE \
+      -f 04-container-apps-environment/deploy.aca-environment.bicep \
+      -p 04-container-apps-environment/deploy.aca-environment.parameters.jsonc \
+      -p hubVNetId=${RESOURCEID_VNET_HUB} spokeVNetName=${RESOURCENAME_VNET_SPOKE} enableApplicationInsights=true enableDaprInstrumentation=true \
+      -p logAnalyticsWorkspaceId=${LOG_ANALYTICS_WS_ID}
+   ```
+
+1. Explore your final infrastructure. *Optional.*
+
+   Now would be a good time to familiarize yourself with all core resources that are part of this architecture, as they are all deployed. This includes the networking layer, the application platform, and all supporting resources. It does not include any of the resources that are specific to a workload (such as public Internet ingress through an application gateway). Check out the following resource groups in the [Azure portal](https://portal.azure.com).
+
+   ```bash
+   RESOURCENAME_RESOURCEGROUP_HUB=$(az deployment sub show -n acalza01-hub --query properties.outputs.resourceGroupName.value -o tsv)
+
+   echo Hub Resource Group: $RESOURCENAME_RESOURCEGROUP_HUB && \
+   echo Spoke Resource Group: $RESOURCENAME_RESOURCEGROUP_SPOKE
+   ```
+
+## Next step
+
+:arrow_forward: [Deploy a sample application](../05-hello-world-sample-app/README.md)
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/container-apps-environment/deploy.aca-environment.bicep b/avm/ptn/aca-lza/hosting-environment/modules/container-apps-environment/deploy.aca-environment.bicep
new file mode 100644
index 0000000000..b4f9a96c79
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/container-apps-environment/deploy.aca-environment.bicep
@@ -0,0 +1,178 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+@description('The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long.')
+@maxLength(8)
+param environment string
+
+@description('The location where the resources will be created. This needs to be the same region as the spoke.')
+param location string = resourceGroup().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+// Hub
+@description('The resource ID of the existing hub virtual network.')
+param hubVNetId string
+
+// Spoke
+@description('The name of the existing spoke virtual network.')
+param spokeVNetName string
+
+@description('The name of the existing spoke infrastructure subnet.')
+param spokeInfraSubnetName string
+
+// Telemetry
+@description('Enable or disable the createion of Application Insights.')
+param enableApplicationInsights bool
+
+@description('Enable or disable Dapr application instrumentation using Application Insights. If enableApplicationInsights is false, this parameter is ignored.')
+param enableDaprInstrumentation bool
+
+@description('The resource id of an existing Azure Log Analytics Workspace.')
+param logAnalyticsWorkspaceId string
+
+@description('Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false.')
+param deployZoneRedundantResources bool = true
+
+@description('The resource ID of the user-assigned managed identity for the Azure Container Registry to be able to pull images from it.')
+param containerRegistryUserAssignedIdentityId string
+// ------------------
+// VARIABLES
+// ------------------
+var workProfileName = 'general-purpose'
+var virtualNetworkLinks = concat(
+  [
+    {
+      virtualNetworkResourceId: spokeVNet.id
+      registrationEnabled: false
+    }
+  ],
+  (!empty(hubVNetId))
+    ? [
+        {
+          virtualNetworkResourceId: hubVNetId
+          registrationEnabled: false
+        }
+      ]
+    : []
+)
+
+// ------------------
+// EXISTING RESOURCES
+// ------------------
+
+@description('The existing spoke virtual network.')
+resource spokeVNet 'Microsoft.Network/virtualNetworks@2022-01-01' existing = {
+  name: spokeVNetName
+
+  resource infraSubnet 'subnets' existing = {
+    name: spokeInfraSubnetName
+  }
+}
+
+// ------------------
+// RESOURCES
+// ------------------
+
+@description('User-configured naming rules')
+module naming '../naming/naming.module.bicep' = {
+  name: take('acaNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(resourceGroup().id)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+@description('Azure Application Insights, the workload\' log & metric sink and APM tool')
+module applicationInsights 'br/public:avm/res/insights/component:0.3.1' = if (enableApplicationInsights) {
+  name: take('applicationInsights-${uniqueString(resourceGroup().id)}', 64)
+  params: {
+    name: naming.outputs.resourcesNames.applicationInsights
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    workspaceResourceId: logAnalyticsWorkspaceId
+  }
+}
+
+@description('The Azure Container Apps (ACA) cluster.')
+module containerAppsEnvironment 'br/public:avm/res/app/managed-environment:0.5.1' = {
+  name: take('acaenv-${uniqueString(resourceGroup().id)}', 64)
+  params: {
+    logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceId
+    name: naming.outputs.resourcesNames.containerAppsEnvironment
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    internal: true
+    managedIdentities: {
+      userAssignedResourceIds: [
+        containerRegistryUserAssignedIdentityId
+      ]
+    }
+    daprAIInstrumentationKey: (enableDaprInstrumentation && enableApplicationInsights)
+      ? applicationInsights.outputs.instrumentationKey
+      : null
+    infrastructureSubnetId: spokeVNet::infraSubnet.id
+    workloadProfiles: [
+      {
+        maximumCount: 3
+        minimumCount: 0
+        name: workProfileName
+        workloadProfileType: 'D4'
+      }
+    ]
+    zoneRedundant: deployZoneRedundantResources
+  }
+}
+
+@description('The Private DNS zone containing the ACA load balancer IP')
+module containerAppsEnvironmentPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.3.0' = {
+  name: 'acaDnsZoneDeployment-${uniqueString(resourceGroup().id)}'
+  params: {
+    name: containerAppsEnvironment.outputs.defaultDomain
+    location: 'global'
+    tags: tags
+    enableTelemetry: enableTelemetry
+    virtualNetworkLinks: virtualNetworkLinks
+    a: [
+      {
+        name: '*'
+        aRecords: [
+          {
+            ipv4Address: containerAppsEnvironment.outputs.staticIp
+          }
+        ]
+      }
+    ]
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The resource ID of the Container Apps environment.')
+output containerAppsEnvironmentId string = containerAppsEnvironment.outputs.resourceId
+
+@description('The name of the Container Apps environment.')
+output containerAppsEnvironmentName string = containerAppsEnvironment.outputs.name
+
+@description('The name of the Application Insights instance.')
+output applicationInsightsName string = (enableApplicationInsights) ? applicationInsights.outputs.name : ''
+
+@description('The name of the workload profiles provisioned in the Container Apps environment.')
+output workloadProfileNames array = [workProfileName]
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/front-door/deploy.front-door.bicep b/avm/ptn/aca-lza/hosting-environment/modules/front-door/deploy.front-door.bicep
new file mode 100644
index 0000000000..d6823451d4
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/front-door/deploy.front-door.bicep
@@ -0,0 +1,197 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+@description('The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long.')
+@maxLength(8)
+param environment string
+
+@description('The location where the resources will be created.')
+param location string = resourceGroup().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+// Container App Environment
+@description('The ID of the Container Apps environment to be used for the deployment. (e.g. /subscriptions/XXX/resourceGroups/XXX/providers/Microsoft.App/managedEnvironments/XXX)')
+param containerAppsEnvironmentId string
+
+// Private Link Service
+@description('The resource ID of the subnet to be used for the private link service. (e.g. /subscriptions/XXX/resourceGroups/XXX/providers/Microsoft.Network/virtualNetworks/XXX/subnets/XXX)')
+param privateLinkSubnetId string
+
+@description('The name of the front door endpoint to be created.')
+param frontDoorEndpointName string = 'fde-containerapps'
+
+@description('The name of the front door origin group to be created.')
+param frontDoorOriginGroupName string = 'containerapps-origin-group'
+
+@description('The name of the front door origin to be created.')
+param frontDoorOriginName string = 'containerapps-origin'
+
+@description('The name of the front door origin route to be created.')
+param frontDoorOriginRouteName string = 'containerapps-route'
+
+@description('The host name of the front door origin to be created.')
+param frontDoorOriginHostName string
+
+// ------------------
+// VARIABLES
+// ------------------
+
+var containerAppsEnvironmentTokens = split(containerAppsEnvironmentId, '/')
+var containerAppsEnvironmentSubscriptionId = containerAppsEnvironmentTokens[2]
+var containerAppsEnvironmentResourceGroupName = containerAppsEnvironmentTokens[4]
+var containerAppsEnvironmentName = containerAppsEnvironmentTokens[8]
+
+var privateLinkServiceName = '${naming.outputs.resourceTypeAbbreviations.privateLinkService}-${naming.outputs.resourcesNames.frontDoor}'
+
+// ------------------
+// RESOURCES
+// ------------------
+resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2024-03-01' existing = {
+  scope: resourceGroup(containerAppsEnvironmentSubscriptionId, containerAppsEnvironmentResourceGroupName)
+  name: containerAppsEnvironmentName
+}
+
+module naming '../naming/naming.module.bicep' = {
+  name: take('frontDoorNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(resourceGroup().id)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+module privateLinkService 'private-link-service.bicep' = {
+  name: 'privateLinkServiceFrontDoorDeployment-${uniqueString(resourceGroup().id)}'
+  params: {
+    location: location
+    tags: tags
+    containerAppsDefaultDomainName: containerAppsEnvironment.properties.defaultDomain
+    containerAppsEnvironmentSubscriptionId: containerAppsEnvironmentSubscriptionId
+    privateLinkServiceName: privateLinkServiceName
+    privateLinkSubnetId: privateLinkSubnetId
+  }
+}
+
+module frontDoor 'br/public:avm/res/cdn/profile:0.3.0' = {
+  name: 'frontDoorDeployment-${uniqueString(resourceGroup().id)}'
+  params: {
+    // Required parameters
+    name: 'dep-test-cdnpmax'
+    location: 'Global'
+    sku: 'Premium_AzureFrontDoor'
+    tags: tags
+    enableTelemetry: enableTelemetry
+    originResponseTimeoutSeconds: 60
+    // Non-required parameters
+    endpointProperties: {
+      contentTypesToCompress: [
+        'application/javascript'
+        'application/json'
+        'application/x-javascript'
+        'application/xml'
+        'text/css'
+        'text/html'
+        'text/javascript'
+        'text/plain'
+      ]
+      geoFilters: []
+      isCompressionEnabled: true
+      isHttpAllowed: true
+      isHttpsAllowed: true
+      queryStringCachingBehavior: 'IgnoreQueryString'
+    }
+    originGroups: (!empty(frontDoorOriginHostName))
+      ? [
+          {
+            name: frontDoorOriginGroupName
+            loadBalancingSettings: {
+              sampleSize: 4
+              successfulSamplesRequired: 3
+              additionalLatencyInMilliseconds: 50
+            }
+            healthProbeSettings: {
+              probePath: '/'
+              probeRequestType: 'HEAD'
+              probeProtocol: 'Https'
+              probeIntervalInSeconds: 100
+            }
+            sessionAffinityState: 'Disabled'
+            origins: [
+              {
+                name: frontDoorOriginName
+                hostName: frontDoorOriginHostName
+                httpPort: 80
+                httpsPort: 443
+                originHostHeader: frontDoorOriginHostName
+                priority: 1
+                weight: 1000
+                enabledState: 'Enabled'
+                sharedPrivateLinkResource: {
+                  privateLink: {
+                    id: privateLinkService.outputs.privateLinkServiceId
+                  }
+                  privateLinkLocation: location
+                  requestMessage: 'frontdoor'
+                }
+                enforceCertificateNameCheck: true
+              }
+            ]
+          }
+        ]
+      : []
+    afdEndpoints: [
+      {
+        name: frontDoorEndpointName
+        originGroup: frontDoorOriginGroupName
+        enabledState: 'Enabled'
+        routes: [
+          {
+            name: frontDoorOriginRouteName
+            originPath: '/'
+            ruleSets: []
+            supportedProtocols: [
+              'Http'
+              'Https'
+            ]
+            patternsToMatch: [
+              '/*'
+            ]
+            forwardingProtocol: 'HttpsOnly'
+            linkToDefaultDomain: 'Enabled'
+            httpsRedirect: 'Enabled'
+            enabledState: 'Enabled'
+          }
+        ]
+      }
+    ]
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The ID of the front door resource.')
+output frontDoorResourceId string = frontDoor.outputs.resourceId
+@description('The ID of the private link service.')
+output privateLinkServiceId string = privateLinkService.outputs.privateLinkServiceId
+@description('The ID of the private link endpoint connection to approve.')
+output privateLinkEndpointConnectionId string = length(privateLinkService.outputs.privateEndpointConnections) > 0
+  ? filter(
+      privateLinkService.outputs.privateEndpointConnections,
+      (connection) => connection.properties.privateLinkServiceConnectionState.description == 'frontdoor'
+    )[0].id
+  : ''
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/front-door/private-link-service.bicep b/avm/ptn/aca-lza/hosting-environment/modules/front-door/private-link-service.bicep
new file mode 100644
index 0000000000..41dfe7c165
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/front-door/private-link-service.bicep
@@ -0,0 +1,72 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The location where the resources will be created.')
+param location string = resourceGroup().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('The name of the private link service to create.')
+param privateLinkServiceName string
+
+@description('SubnetId used to configure private link service.')
+param privateLinkSubnetId string
+
+@description('Azure Container Apps Environment Default Domain Name')
+param containerAppsDefaultDomainName string
+
+@description('Azure Container Apps Environment Subscription Id')
+param containerAppsEnvironmentSubscriptionId string
+
+// ------------------
+// VARIABLES
+// ------------------
+
+// => Resolve container apps environment managed resource group name to get the frontend Ip configuration
+var containerAppsDefaultDomainArray = split(containerAppsDefaultDomainName, '.')
+var containerAppsNameIdentifier = containerAppsDefaultDomainArray[lastIndexOf(containerAppsDefaultDomainArray, location) - 1]
+var containerAppsManagedResourceGroup = 'MC_${containerAppsNameIdentifier}-rg_${containerAppsNameIdentifier}_${location}'
+
+// ------------------
+// RESOURCES
+// ------------------
+
+resource loadBalancer 'Microsoft.Network/loadBalancers@2021-05-01' existing = {
+  name: 'kubernetes-internal'
+  scope: resourceGroup(containerAppsEnvironmentSubscriptionId, containerAppsManagedResourceGroup)
+}
+
+// CANOT USE MODULE HERE BECAUSE OF THE LOADBALANCER RUNTIME FRONTEND IP CONFIGURATION RETRIEVAL
+resource privateLinkService 'Microsoft.Network/privateLinkServices@2023-11-01' = {
+  name: privateLinkServiceName
+  location: location
+  tags: tags
+  properties: {
+    loadBalancerFrontendIpConfigurations: [
+      {
+        id: loadBalancer.properties.frontendIPConfigurations[0].id
+      }
+    ]
+    ipConfigurations: [
+      {
+        name: 'snet-provider-default-1'
+        properties: {
+          privateIPAllocationMethod: 'Dynamic'
+          subnet: {
+            id: privateLinkSubnetId
+          }
+          primary: true
+          privateIPAddressVersion: 'IPv4'
+        }
+      }
+    ]
+  }
+}
+
+output privateLinkServiceId string = privateLinkService.id
+
+output privateEndpointConnections array = privateLinkService.properties.privateEndpointConnections
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/naming/naming-rules.jsonc b/avm/ptn/aca-lza/hosting-environment/modules/naming/naming-rules.jsonc
new file mode 100644
index 0000000000..2a1c4d0112
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/naming/naming-rules.jsonc
@@ -0,0 +1,90 @@
+{
+    // Recommended abreviations: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations
+    "resourceTypeAbbreviations" : {
+        "applicationGateway": "agw",
+        "applicationInsights": "appi",
+        "appService": "app",
+        "azureFirewall": "azfw",
+        "bastion": "bas",
+        "containerAppsEnvironment": "cae",
+        "containerRegistry": "cr",
+        "cosmosDbNoSql": "cosno",
+        "frontDoor": "afd",
+        "frontDoorEndpoint": "fde",
+        "frontDoorWaf": "fdfp",
+        "keyVault": "kv",
+        "logAnalyticsWorkspace": "log",
+        "managedIdentity": "id",
+        "networkInterface": "nic",
+        "networkSecurityGroup": "nsg",
+        "privateEndpoint": "pep",
+        "privateLinkService": "pls",
+        "publicIpAddress": "pip",
+        "resourceGroup": "rg",
+        "routeTable": "rt",
+        "serviceBus": "sb",
+        "serviceBusQueue": "sbq",
+        "serviceBusTopic": "sbt",
+        "storageAccount": "st",
+        "virtualMachine": "vm",
+        "virtualNetwork": "vnet",
+        "redisCache": "redis",
+        "cognitiveAccount": "cog",
+        "openAiDeployment": "oaidep",
+        "azureAISearch": "srch",
+        "documentIntelligence": "di",
+        "eventGridSystemTopic": "egst",
+        "eventGridSubscription": "evgs"
+    },
+
+    //copied from here: https://github.com/nianton/azure-naming/blob/main/datafiles/regionAbbreviations.json
+    "regionAbbreviations" : {
+        "australiacentral": "auc",
+        "australiacentral2": "auc2",
+        "australiaeast": "aue",
+        "australiasoutheast": "ause",
+        "brazilsouth": "brs",
+        "brazilsoutheast": "brse",
+        "canadacentral": "canc",
+        "canadaeast": "cane",
+        "centralindia": "cin",
+        "centralus": "cus",
+        "centraluseuap": "cuseuap",
+        "eastasia": "ea",
+        "eastus": "eus",
+        "eastus2": "eus2",
+        "eastus2euap": "eus2euap",
+        "francecentral": "frc",
+        "francesouth": "frs",
+        "germanynorth": "gern",
+        "germanywestcentral": "gerwc",
+        "japaneast": "jae",
+        "japanwest": "jaw",
+        "jioindiacentral": "jioinc",
+        "jioindiawest": "jioinw",
+        "koreacentral": "koc",
+        "koreasouth": "kors",
+        "northcentralus": "ncus",
+        "northeurope": "neu",
+        "norwayeast": "nore",
+        "norwaywest": "norw",
+        "southafricanorth": "san",
+        "southafricawest": "saw",
+        "southcentralus": "scus",
+        "southeastasia": "sea",
+        "southindia": "sin",
+        "swedencentral": "swc",
+        "switzerlandnorth": "swn",
+        "switzerlandwest": "sww",
+        "uaecentral": "uaec",
+        "uaenorth": "uaen",
+        "uksouth": "uks",
+        "ukwest": "ukw",
+        "westcentralus": "wcus",
+        "westeurope": "weu",
+        "westindia": "win",
+        "westus": "wus",
+        "westus2": "wus2",
+        "westus3": "wus3"
+    }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/naming/naming.module.bicep b/avm/ptn/aca-lza/hosting-environment/modules/naming/naming.module.bicep
new file mode 100644
index 0000000000..386456b923
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/naming/naming.module.bicep
@@ -0,0 +1,117 @@
+// ------------------
+//    PARAMETERS
+// ------------------
+@minLength(2)
+@maxLength(10)
+@description('The name of the workloard that is being deployed. Up to 10 characters long.')
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa") Up to 8 characters long.')
+@maxLength(8)
+param environment string
+
+@description('Location for all Resources.')
+param location string
+
+@description('a unique ID that can be appended (or prepended) in azure resource names that require some kind of uniqueness')
+param uniqueId string
+
+// ------------------
+// VARIABLES
+// ------------------
+
+var naming = json(loadTextContent('./naming-rules.jsonc'))
+
+// get arbitary 5 first characters (instead of something like 5yj4yjf5mbg72), to save string length.
+var uniqueIdShort = substring(uniqueId, 0, 5)
+var resourceTypeToken = 'RES_TYPE'
+
+// Define and adhere to a naming convention, such as: https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming
+var namingBase = '${resourceTypeToken}-${workloadName}-${environment}-${naming.regionAbbreviations[toLower(location)]}'
+var namingBaseUnique = '${resourceTypeToken}-${workloadName}-${uniqueIdShort}-${environment}-${naming.regionAbbreviations[toLower(location)]}'
+
+// Used for hub resources - should be shared across different workloads
+var namingBaseNoWorkloadName = '${resourceTypeToken}-${environment}-${naming.regionAbbreviations[toLower(location)]}'
+
+var resourceTypeAbbreviations = naming.resourceTypeAbbreviations
+
+var keyVaultName = take(replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.keyVault), 24)
+
+var resourceNames = {
+  vnetSpoke: '${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.virtualNetwork)}-spoke'
+  vnetHub: '${replace(namingBaseNoWorkloadName, resourceTypeToken, naming.resourceTypeAbbreviations.virtualNetwork)}-hub'
+  applicationGateway: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.applicationGateway)
+  applicationGatewayPip: '${naming.resourceTypeAbbreviations.publicIpAddress}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.applicationGateway)}'
+  applicationGatewayUserAssignedIdentity: '${naming.resourceTypeAbbreviations.managedIdentity}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.applicationGateway)}-KeyVaultSecretUser'
+  applicationGatewayNsg: '${naming.resourceTypeAbbreviations.networkSecurityGroup}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.applicationGateway)}'
+  pepNsg: '${naming.resourceTypeAbbreviations.networkSecurityGroup}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.privateEndpoint)}'
+  applicationInsights: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.applicationInsights)
+  azureFirewall: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.azureFirewall)
+  azureFirewallPip: '${naming.resourceTypeAbbreviations.publicIpAddress}-${replace(namingBaseNoWorkloadName, resourceTypeToken, naming.resourceTypeAbbreviations.azureFirewall)}'
+  bastion: replace(namingBaseNoWorkloadName, resourceTypeToken, naming.resourceTypeAbbreviations.bastion)
+  bastionNsg: '${naming.resourceTypeAbbreviations.networkSecurityGroup}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.bastion)}'
+  bastionPip: '${naming.resourceTypeAbbreviations.publicIpAddress}-${replace(namingBaseNoWorkloadName, resourceTypeToken, naming.resourceTypeAbbreviations.bastion)}'
+  containerAppsEnvironment: replace(
+    namingBase,
+    resourceTypeToken,
+    naming.resourceTypeAbbreviations.containerAppsEnvironment
+  )
+  containerAppsEnvironmentNsg: '${naming.resourceTypeAbbreviations.networkSecurityGroup}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.containerAppsEnvironment)}'
+  containerRegistry: take(
+    toLower(replace(
+      replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.containerRegistry),
+      '-',
+      ''
+    )),
+    50
+  )
+  containerRegistryPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${toLower( replace ( replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.containerRegistry), '-', '' ) )}'
+  containerRegistryUserAssignedIdentity: '${naming.resourceTypeAbbreviations.managedIdentity}-${toLower( replace ( replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.containerRegistry), '-', '' ) )}-AcrPull'
+  redisCache: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.redisCache)
+  redisCachePep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${replace ( namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.redisCache )}'
+  openAiAccount: replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.cognitiveAccount)
+  openAiDeployment: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.openAiDeployment)
+  cosmosDbNoSql: toLower(take(
+    replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.cosmosDbNoSql),
+    44
+  ))
+  cosmosDbNoSqlPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${toLower( take(replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.cosmosDbNoSql), 44) )}'
+  frontDoorProfile: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.frontDoor)
+  keyVault: endsWith(keyVaultName, '-') ? take(keyVaultName, 23) : keyVaultName
+  keyVaultPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${replace ( namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.keyVault )}'
+  logAnalyticsWorkspace: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.logAnalyticsWorkspace)
+  routeTable: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.routeTable)
+  serviceBus: replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.serviceBus)
+  serviceBusPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.serviceBus)}'
+  storageAccount: toLower(take(
+    replace(replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.storageAccount), '-', ''),
+    24
+  ))
+  storageAccountPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${toLower( replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.storageAccount))}'
+  vmJumpBox: replace(namingBaseNoWorkloadName, resourceTypeToken, naming.resourceTypeAbbreviations.virtualMachine)
+  vmJumpBoxNsg: '${naming.resourceTypeAbbreviations.networkSecurityGroup}-${replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.virtualMachine)}'
+  vmJumpBoxNic: '${naming.resourceTypeAbbreviations.networkInterface}-${replace(namingBaseNoWorkloadName, resourceTypeToken, naming.resourceTypeAbbreviations.virtualMachine)}'
+  frontDoor: replace(namingBase, resourceTypeToken, naming.resourceTypeAbbreviations.frontDoor)
+  azureAISearch: replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.azureAISearch)
+  azureAISearchPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${replace ( namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.azureAISearch )}'
+  documentIntelligence: replace(
+    namingBaseUnique,
+    resourceTypeToken,
+    naming.resourceTypeAbbreviations.documentIntelligence
+  )
+  documentIntelligencePep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${replace ( namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.documentIntelligence )}'
+  eventGridSystemTopic: replace(
+    namingBaseUnique,
+    resourceTypeToken,
+    naming.resourceTypeAbbreviations.eventGridSystemTopic
+  )
+  eventGridSystemTopicPep: '${naming.resourceTypeAbbreviations.privateEndpoint}-${replace(namingBaseUnique, resourceTypeToken, naming.resourceTypeAbbreviations.eventGridSystemTopic)}'
+  eventGridSubscription: replace(
+    namingBaseUnique,
+    resourceTypeToken,
+    naming.resourceTypeAbbreviations.eventGridSubscription
+  )
+}
+
+output resourcesNames object = resourceNames
+output resourceTypeAbbreviations object = resourceTypeAbbreviations
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/networking/peering.bicep b/avm/ptn/aca-lza/hosting-environment/modules/networking/peering.bicep
new file mode 100644
index 0000000000..4fd0a55013
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/networking/peering.bicep
@@ -0,0 +1,24 @@
+@description('The name of the local Virtual Network')
+param localVnetName string
+
+@description('The name of the remote Virtual Network')
+param remoteVnetName string
+
+@description('The name of the resource group of the remote virtual netowrk')
+param remoteRgName string
+
+@description('The id of the subscription of the remote virtual netowrk')
+param remoteSubscriptionId string
+
+resource vnetPeering 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings@2021-08-01' = {
+  name: '${localVnetName}/peerTo-${remoteVnetName}'
+  properties: {
+    allowVirtualNetworkAccess: true
+    allowGatewayTransit: false
+    allowForwardedTraffic: false
+    useRemoteGateways: false
+    remoteVirtualNetwork: {
+      id: resourceId(remoteSubscriptionId, remoteRgName, 'Microsoft.Network/virtualNetworks', remoteVnetName)
+    }
+  }
+}
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policies-assignement.bicep b/avm/ptn/aca-lza/hosting-environment/modules/policy/policies-assignement.bicep
new file mode 100644
index 0000000000..2c851cc735
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policies-assignement.bicep
@@ -0,0 +1,268 @@
+targetScope = 'managementGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The location where the resources will be created.')
+param location string
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+@description('The name of the resource group where the resources will be created.')
+param spokeResourceGroupName string
+
+@description('The name of the Container Registry that will be allow-listed by the policy.')
+param containerRegistryName string
+
+// ------------------
+//  VARIABLES
+// ------------------
+// Azure Container Apps Built-in Policy Definitions: https://learn.microsoft.com/azure/container-apps/policy-reference#policy-definitions
+var builtInPolicies = [
+  {
+    name: 'authentication-should-be-enabled-on-container-apps'
+    definition: {
+      properties: {
+        displayName: 'Authentication should be enabled on container apps'
+        description: 'Container Apps Authentication is a feature that can prevent anonymous HTTP requests from reaching the Container App, or authenticate those that have tokens before they reach the Container App'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'AuditIfNotExists'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/2b585559-a78e-4cc4-b1aa-fb169d2f6b96'
+  }
+  {
+    name: 'container-app-environments-should-use-network-injection'
+    definition: {
+      properties: {
+        displayName: 'Container App environments should use network injection'
+        description: 'Container Apps environments should use virtual network injection to: 1.Isolate Container Apps from the public internet 2.Enable network integration with resources on-premises or in other Azure virtual networks 3.Achieve more granular control over network traffic flowing to and from the environment'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/8b346db6-85af-419b-8557-92cee2c0f9bb'
+  }
+  {
+    name: 'container-app-should-configure-with-volume-mount'
+    definition: {
+      properties: {
+        displayName: 'Container App should configure with volume mount'
+        description: 'Enforce the use of volume mounts for Container Apps to ensure availability of persistent storage capacity'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/7c9f3fbb-739d-4844-8e42-97e3be6450e0'
+  }
+  {
+    name: 'container-app-should-disable-public-network-access'
+    definition: {
+      properties: {
+        displayName: 'Container Apps environment should disable public network access'
+        description: 'Disable public network access to improve security by exposing the Container Apps environment through an internal load balancer. This removes the need for a public IP address and prevents internet access to all Container Apps within the environment.'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/d074ddf8-01a5-4b5e-a2b8-964aed452c0a'
+  }
+  {
+    name: 'container-apps-should-disable-external-network-access'
+    definition: {
+      properties: {
+        displayName: 'Container Apps should disable external network access'
+        description: 'Disable external network access to your Container Apps by enforcing internal-only ingress. This will ensure inbound communication for Container Apps is limited to callers within the Container Apps environment'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/783ea2a8-b8fd-46be-896a-9ae79643a0b1'
+  }
+  {
+    name: 'containerapps-should-only-be-accessible-over-HTTPS'
+    definition: {
+      properties: {
+        displayName: 'Container Apps should only be accessible over HTTPS'
+        description: 'Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Disabling "allowInsecur" will result in the automatic redirection of requests from HTTP to HTTPS connections for container apps.'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb'
+  }
+  {
+    name: 'managed-identity-should-be-enabled'
+    definition: {
+      properties: {
+        displayName: 'Managed Identity should be enabled for Container Apps'
+        description: 'Enforcing managed identity ensures Container Apps can securely authenticate to any resource that supports Azure AD authentication'
+      }
+    }
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/b874ab2d-72dd-47f1-8cb5-4a306478a4e7'
+  }
+]
+
+// credits: https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-policy-for-azure-container-apps-yes-please/ba-p/3775200
+// https://github.com/Azure-Samples/aca-azure-policy/tree/main
+var customPolicies = [
+  {
+    name: 'aca-allowed-container-registries'
+    definition: json(loadTextContent('policy-definitions/aca-allowed-container-registries.json'))
+    parameters: {
+      listOfAllowedContainerRegistries: {
+        value: [
+          'mcr.microsoft.com'
+          'docker.io'
+          'ghcr.io'
+          '${containerRegistryName}.azurecr.io'
+        ]
+      }
+      effect: {
+        value: 'Audit'
+      }
+    }
+  }
+  {
+    name: 'aca-replica-count'
+    definition: json(loadTextContent('policy-definitions/aca-replica-count.json'))
+    parameters: {
+      minReplicas: {
+        value: 0
+      }
+      maxReplicas: {
+        value: 30
+      }
+      effect: {
+        value: 'Audit'
+      }
+    }
+    identity: false
+  }
+  {
+    name: 'aca-no-liveness-probes'
+    definition: json(loadTextContent('policy-definitions/aca-no-liveness-probes.json'))
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    identity: false
+  }
+  {
+    name: 'aca-no-readiness-probes'
+    definition: json(loadTextContent('policy-definitions/aca-no-readiness-probes.json'))
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    identity: false
+  }
+  {
+    name: 'aca-no-startup-probes'
+    definition: json(loadTextContent('policy-definitions/aca-no-startup-probes.json'))
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    identity: false
+  }
+  {
+    name: 'aca-required-cpu-and-memory'
+    definition: json(loadTextContent('policy-definitions/aca-required-cpu-and-memory.json'))
+    parameters: {
+      maxCpu: {
+        value: '1.0'
+      }
+      maxMemory: {
+        value: '2.5'
+      }
+      effect: {
+        value: 'Audit'
+      }
+    }
+    identity: false
+  }
+  {
+    name: 'aca-no-monitoring'
+    definition: json(loadTextContent('policy-definitions/aca-no-monitoring.json'))
+    parameters: {
+      effect: {
+        value: 'Audit'
+      }
+    }
+    identity: false
+  }
+]
+
+module builtInPolicyAssignment 'br/public:avm/ptn/authorization/policy-assignment:0.1.0' = [
+  for (policy, i) in builtInPolicies: {
+    name: 'poAssign_${take(policy.name, 40)}'
+    params: {
+      name: policy.name
+      location: location
+      enableTelemetry: enableTelemetry
+      policyDefinitionId: policy.policyDefinitionId
+      resourceGroupName: spokeResourceGroupName
+    }
+  }
+]
+
+//TODO: Needs to be updated when the AVM is implemented
+resource customPoliciesDefinition 'Microsoft.Authorization/policyDefinitions@2021-06-01' = [
+  for policy in customPolicies: {
+    name: guid(policy.name)
+    properties: {
+      description: policy.definition.properties.description
+      displayName: policy.definition.properties.displayName
+      metadata: policy.definition.properties.metadata
+      mode: policy.definition.properties.mode
+      parameters: policy.definition.properties.parameters
+      policyType: policy.definition.properties.policyType
+      policyRule: policy.definition.properties.policyRule
+    }
+  }
+]
+
+module cusomPoliciesAssignement 'br/public:avm/ptn/authorization/policy-assignment:0.1.0' = [
+  for (policy, i) in customPolicies: {
+    name: 'poAssign_${take(policy.name, 40)}'
+    params: {
+      name: policy.name
+      location: location
+      enableTelemetry: enableTelemetry
+      policyDefinitionId: customPoliciesDefinition[i].id
+      resourceGroupName: spokeResourceGroupName
+    }
+    dependsOn: [
+      customPoliciesDefinition
+    ]
+  }
+]
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-container-registries.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-container-registries.json
new file mode 100644
index 0000000000..9852ed681d
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-container-registries.json
@@ -0,0 +1,59 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps allowed container registries",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enables you to restrict the list of container registries for Azure Container Apps.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "listOfAllowedContainerRegistries": {
+        "type": "Array",
+        "metadata": {
+          "displayName": "Allowed container registries",
+          "description": "The list of container registries that can be specified when deploying resources."
+        },
+        "defaultValue": [
+          "mcr.microsoft.com"
+        ]
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "count": {
+              "field": "Microsoft.App/containerApps/template.containers[*]",
+              "where": {
+                "value": "[split(first(field('Microsoft.App/containerApps/template.containers[*].image')), '/')[0]]",
+                "notIn": "[parameters('listOfAllowedContainerRegistries')]"
+              }
+            },
+            "greater": 0
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-ingress-target-ports.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-ingress-target-ports.json
new file mode 100644
index 0000000000..23779be261
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-ingress-target-ports.json
@@ -0,0 +1,64 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps allowed ingress target ports",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enables you to restrict the list of ingress target ports for Azure Container Apps.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "listOfAllowedIngressTargetPorts": {
+        "type": "Array",
+        "metadata": {
+          "displayName": "Allowed container ports",
+          "description": "The list of container ports that can be specified when deploying resources."
+        },
+        "defaultValue": [
+          80,
+          443
+        ]
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "field": "Microsoft.App/containerApps/configuration.ingress",
+            "exists": true
+          },
+          {
+            "not": {
+              "field": "Microsoft.App/containerApps/configuration.ingress",
+              "equals": ""
+            }
+          },
+          {
+            "field": "Microsoft.App/containerApps/configuration.ingress.targetPort",
+            "notIn": "[parameters('listOfAllowedIngressTargetPorts')]"
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-ingress-transports.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-ingress-transports.json
new file mode 100644
index 0000000000..6bf941b970
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-ingress-transports.json
@@ -0,0 +1,64 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps allowed ingress transports",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enables you to restrict the list of ingress transports for Azure Container Apps.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "listOfAllowedIngressTransports": {
+        "type": "Array",
+        "metadata": {
+          "displayName": "Allowed container transports",
+          "description": "The list of container transports that can be specified when deploying resources."
+        },
+        "defaultValue": [
+          80,
+          443
+        ]
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "field": "Microsoft.App/containerApps/configuration.ingress",
+            "exists": true
+          },
+          {
+            "not": {
+              "field": "Microsoft.App/containerApps/configuration.ingress",
+              "equals": ""
+            }
+          },
+          {
+            "field": "Microsoft.App/containerApps/configuration.ingress.transport",
+            "notIn": "[parameters('listOfAllowedIngressTransports')]"
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-locations.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-locations.json
new file mode 100644
index 0000000000..f19f2ac164
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-allowed-locations.json
@@ -0,0 +1,67 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps allowed locations",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enables you to restrict the locations for Azure Container Apps.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "listOfAllowedLocations": {
+        "type": "Array",
+        "metadata": {
+          "displayName": "Allowed locations",
+          "description": "The list of locations that can be specified when deploying resources.",
+          "strongType": "location"
+        },
+        "defaultValue": [
+          "northeurope",
+          "westeurope",
+          "eastus2"
+        ]
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "location",
+            "notIn": "[parameters('listOfAllowedLocations')]"
+          },
+          {
+            "field": "location",
+            "notEquals": "global"
+          },
+          {
+            "anyOf": [{
+                "field": "type",
+                "equals": "Microsoft.App/managedEnvironments"
+              },
+              {
+                "field": "type",
+                "equals": "Microsoft.App/containerApps"
+              }
+            ]
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-diagnostic-settings.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-diagnostic-settings.json
new file mode 100644
index 0000000000..7753edc507
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-diagnostic-settings.json
@@ -0,0 +1,78 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps no diagnostic settings configured",
+    "policyType": "Custom",
+    "mode": "All",
+    "description": "When the environment configure to collect logs and metrics to Azure Monitor, checks whether diagnostic settings have been defined.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "logsEnabled": {
+        "type": "Boolean",
+        "metadata": {
+          "displayName": "Logs Enabled"
+        },
+        "allowedValues": [
+          true,
+          false
+        ],
+        "defaultValue": true
+      },
+      "metricsEnabled": {
+        "type": "Boolean",
+        "metadata": {
+          "displayName": "Metrics Enabled"
+        },
+        "allowedValues": [
+          true,
+          false
+        ],
+        "defaultValue": true
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "AuditIfNotExists",
+          "Disabled"
+        ],
+        "defaultValue": "AuditIfNotExists"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/managedEnvironments"
+          },
+          {
+            "field": "Microsoft.App/managedEnvironments/appLogsConfiguration.destination",
+            "equals": "azure-monitor"
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]",
+        "details": {
+          "type": "Microsoft.Insights/diagnosticSettings",
+          "existenceCondition": {
+            "allOf": [{
+                "field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
+                "equals": "[parameters('logsEnabled')]"
+              },
+              {
+                "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
+                "equals": "[parameters('metricsEnabled')]"
+              }
+            ]
+          }
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-liveness-probes.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-liveness-probes.json
new file mode 100644
index 0000000000..2525cdef64
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-liveness-probes.json
@@ -0,0 +1,49 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps no container liveness probes",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enforces that all the containers of Azure Containers Apps have liveness probes configured.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "count": {
+              "field": "Microsoft.App/containerApps/template.containers[*].probes[*]",
+              "where": {
+                "field": "Microsoft.App/containerApps/template.containers[*].probes[*].type",
+                "equals": "Liveness"
+              }
+            },
+            "equals": 0
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-monitoring.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-monitoring.json
new file mode 100644
index 0000000000..2dff563b37
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-monitoring.json
@@ -0,0 +1,43 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps no monitoring configured",
+    "policyType": "Custom",
+    "mode": "All",
+    "description": "This policy enforces that monitoring is configured for Azure Container Apps environments.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/managedEnvironments"
+          },
+          {
+            "field": "Microsoft.App/managedEnvironments/appLogsConfiguration.destination",
+            "exists": false
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-readiness-probes.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-readiness-probes.json
new file mode 100644
index 0000000000..995a872d4c
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-readiness-probes.json
@@ -0,0 +1,49 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps no container readiness probes",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enforces that all the containers of Azure Containers Apps have readiness probes configured.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "count": {
+              "field": "Microsoft.App/containerApps/template.containers[*].probes[*]",
+              "where": {
+                "field": "Microsoft.App/containerApps/template.containers[*].probes[*].type",
+                "equals": "Readiness"
+              }
+            },
+            "equals": 0
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-startup-probes.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-startup-probes.json
new file mode 100644
index 0000000000..6d3a7c1fa2
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-no-startup-probes.json
@@ -0,0 +1,49 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps no container startup probes",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enforces that all the containers of Azure Containers Apps have startup probes configured.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "count": {
+              "field": "Microsoft.App/containerApps/template.containers[*].probes[*]",
+              "where": {
+                "field": "Microsoft.App/containerApps/template.containers[*].probes[*].type",
+                "equals": "Startup"
+              }
+            },
+            "equals": 0
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-replica-count.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-replica-count.json
new file mode 100644
index 0000000000..78accd44b2
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-replica-count.json
@@ -0,0 +1,64 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps container replica count limits",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enforces limits for the minimum and maximum number of replicas for Azure Container Apps.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "minReplicas": {
+        "type": "integer",
+        "metadata": {
+          "displayName": "Min allowed replicas",
+          "description": "Specifies the minimum number of container replicas for the Azure Container App"
+        },
+        "defaultValue": 0
+      },
+      "maxReplicas": {
+        "type": "integer",
+        "metadata": {
+          "displayName": "Max allowed replicas",
+          "description": "Specifies the maximum number of container replicas for the Azure Container App"
+        },
+        "defaultValue": 30
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "anyOf": [{
+              "field": "Microsoft.App/containerApps/template.scale.minReplicas",
+              "less": "[parameters('MinReplicas')]"
+            }, {
+              "field": "Microsoft.App/containerApps/template.scale.maxReplicas",
+              "greater": "[parameters('MaxReplicas')]"
+            }]
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-required-cpu-and-memory.json b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-required-cpu-and-memory.json
new file mode 100644
index 0000000000..bb0e8451d8
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/policy/policy-definitions/aca-required-cpu-and-memory.json
@@ -0,0 +1,78 @@
+{
+  "properties": {
+    "displayName": "Azure Container Apps container required CPU and memory",
+    "policyType": "Custom",
+    "mode": "Indexed",
+    "description": "This policy enforces limits for container CPU and memory requests in an AZure Container App.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Azure Container Apps"
+    },
+    "parameters": {
+      "maxCpu": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Max allowed CPU cores",
+          "description": "Specifies the maximum CPU cores allowed for a container. E.g. 1.25."
+        },
+        "defaultValue": "2.0"
+      },
+      "maxMemory": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Max allowed memory in Gi",
+          "description": "Specifies the maximum memory in Gi allowed for a container. E.g. 2.5"
+        },
+        "defaultValue": "4.0"
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [{
+            "field": "type",
+            "equals": "Microsoft.App/containerApps"
+          },
+          {
+            "anyOf": [{
+                "count": {
+                  "field": "Microsoft.App/containerApps/template.containers[*]",
+                  "where": {
+                    "field": "Microsoft.App/containerApps/template.containers[*].resources.cpu",
+                    "greater": "[float(parameters('maxCpu'))]"
+                  }
+                },
+                "greater": 0
+              },
+              {
+                "count": {
+                  "field": "Microsoft.App/containerApps/template.containers[*]",
+                  "where": {
+                    "value": "[float(substring(first(field('Microsoft.App/containerApps/template.containers[*].resources.memory')), 0, sub(length(first(field('Microsoft.App/containerApps/template.containers[*].resources.memory'))), 2)))]",
+                    "greater": "[float(parameters('maxMemory'))]"
+                  }
+                },
+                "greater": 0
+              }
+            ]
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/sample-application/deploy.sample-application.bicep b/avm/ptn/aca-lza/hosting-environment/modules/sample-application/deploy.sample-application.bicep
new file mode 100644
index 0000000000..b6fd0b1b1c
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/sample-application/deploy.sample-application.bicep
@@ -0,0 +1,73 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The location where the resources will be created. This needs to be the same region as the Azure Container Apps instances.')
+param location string = resourceGroup().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+@description('Optional. The name of the Container App. If set, it overrides the name generated by the template.')
+@minLength(2)
+@maxLength(32)
+param helloWorldContainerAppName string = 'ca-simple-hello'
+
+@description('The resource ID of the existing user-assigned managed identity to be assigned to the Container App to be able to pull images from the container registry.')
+param containerRegistryUserAssignedIdentityId string
+
+@description('The resource ID of the existing Container Apps environment in which the Container App will be deployed.')
+param containerAppsEnvironmentId string
+
+@description('The container apps environment workload profile to use for the Container App.')
+param workloadProfileName string
+
+// ------------------
+// RESOURCES
+// ------------------
+
+module sampleApplication 'br/public:avm/res/app/container-app:0.4.0' = {
+  name: helloWorldContainerAppName
+  params: {
+    name: helloWorldContainerAppName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    environmentId: containerAppsEnvironmentId
+    managedIdentities: {
+      userAssignedResourceIds: [
+        containerRegistryUserAssignedIdentityId
+      ]
+    }
+    workloadProfileName: workloadProfileName
+    containers: [
+      {
+        name: 'simple-hello'
+        image: 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
+        resources: {
+          cpu: json('0.25')
+          memory: '0.5Gi'
+        }
+      }
+    ]
+    scaleMinReplicas: 2
+    scaleMaxReplicas: 10
+    activeRevisionsMode: 'Single'
+    ingressExternal: true
+    ingressAllowInsecure: false
+    ingressTargetPort: 80
+    ingressTransport: 'auto'
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The FQDN of the "Hello World" Container App.')
+output helloWorldAppFqdn string = sampleApplication.outputs.fqdn
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/spoke/README.md b/avm/ptn/aca-lza/hosting-environment/modules/spoke/README.md
new file mode 100644
index 0000000000..f472066c43
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/spoke/README.md
@@ -0,0 +1,53 @@
+# Deploy the spoke network
+
+
+## Networking in this architecture
+
+The regional spoke network in which your application platform is laid into acts as the first line of defense for your workload. This network perimeter forms a security boundary where you will restrict the network line of sight into your resources. It also gives your application platform the ability to use private link to talk to adjacent platform-as-a-service resources such as Key Vault and Azure Container Registry. And finally it acts as a layer to restrict and tunnel egressing traffic. All of this adds up to ensure that workload traffic stays as isolated as possible and free from any possible external influence, including other enterprise workloads.
+
+## Expected results
+
+After executing these steps you'll have the spoke resource group (`rg-lzaaca-spoke-dev-reg`, by default) populated with a virtual network, subnets, and peering to the regional hub. Based on how you configured the naming and deployment parameters, your result may be slightly different.
+
+### Resources
+
+- Spoke resource group
+- Spoke virtual network
+- Peering to and from the hub (optional)
+- Jump box virtual machine (optional)
+
+## Steps
+
+1. Create the regional spoke network.
+
+   ```bash
+   RESOURCEID_VNET_HUB=$(az deployment sub show -n acalza01-hub --query properties.outputs.hubVNetId.value -o tsv)
+   echo RESOURCEID_VNET_HUB: $RESOURCEID_VNET_HUB
+
+   # [This takes about two minutes to run.]
+   az deployment sub create \
+      -n acalza01-spokenetwork \
+      -l $LOCATION \
+      -f 02-spoke/deploy.spoke.bicep -p 02-spoke/deploy.spoke.parameters.jsonc \
+      -p hubVNetId=${RESOURCEID_VNET_HUB}
+   ```
+
+1. Explore your networking resources. *Optional.*
+
+   You may wish to take this moment to familiarize yourself with the resources that have been deployed so far to Azure. They have all been networking resources, establishing the network and access boundaries from within which your application platform will be executing. Check out the following resource groups in the [Azure portal](https://portal.azure.com).
+
+   ```bash
+   RESOURCENAME_RESOURCEGROUP_HUB=$(az deployment sub show -n acalza01-hub --query properties.outputs.resourceGroupName.value -o tsv)
+   RESOURCENAME_RESOURCEGROUP_SPOKE=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.spokeResourceGroupName.value -o tsv)
+
+   echo Hub Resource Group: $RESOURCENAME_RESOURCEGROUP_HUB && \
+   echo Spoke Resource Group: $RESOURCENAME_RESOURCEGROUP_SPOKE
+   ```
+
+## Azure landing zone platform alignment
+
+The creation of the hub resources, spoke virtual network, and routing configuration are usually the responsibility of the connectivity platform team. While the creation of subnets, NSGs, and the workload resources are delegated to the workload team. The deployment steps so far have been a mix of both roles. Be sure to understand your organization's separation of duties in landing zone deployments, and use your organization's subscription vending solution to . From this point on in the walkthrough, the steps are indeed all responsibilities of the workload team.
+
+## Next step
+
+:arrow_forward: [Deploy long-lifecycle resources](../03-supporting-services/README.md)
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/spoke/deploy.spoke.bicep b/avm/ptn/aca-lza/hosting-environment/modules/spoke/deploy.spoke.bicep
new file mode 100644
index 0000000000..32587817dc
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/spoke/deploy.spoke.bicep
@@ -0,0 +1,598 @@
+targetScope = 'subscription'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+// @description('The ID of the subscription to deploy the spoke resources to.')
+// param subscriptionId string
+
+@description('The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long.')
+@maxLength(8)
+param environment string
+
+@description('The location where the resources will be created. This should be the same region as the hub.')
+param location string = deployment().location
+
+@description('Optional. The name of the resource group to create the resources in. If set, it overrides the name generated by the template.')
+param spokeResourceGroupName string
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+// Hub
+@description('The resource ID of the existing hub virtual network.')
+param hubVNetId string
+
+@description('The resource id of the bastion host.')
+param bastionResourceId string
+
+// Spoke
+@description('CIDR of the spoke virtual network. For most landing zone implementations, the spoke network would have been created by your platform team.')
+param spokeVNetAddressPrefixes array
+
+@description('Optional. The name of the subnet to create for the spoke infrastructure. If set, it overrides the name generated by the template.')
+param spokeInfraSubnetName string = 'snet-infra'
+
+@description('CIDR of the spoke infrastructure subnet.')
+param spokeInfraSubnetAddressPrefix string
+
+@description('Optional. The name of the subnet to create for the spoke private endpoints. If set, it overrides the name generated by the template.')
+param spokePrivateEndpointsSubnetName string = 'snet-pep'
+
+@description('CIDR of the spoke private endpoints subnet.')
+param spokePrivateEndpointsSubnetAddressPrefix string
+
+@description('Optional. The name of the subnet to create for the spoke application gateway. If set, it overrides the name generated by the template.')
+param spokeApplicationGatewaySubnetName string = 'snet-agw'
+
+@description('CIDR of the spoke Application Gateway subnet. If the value is empty, this subnet will not be created.')
+param spokeApplicationGatewaySubnetAddressPrefix string
+
+@description('The IP address of the network appliance (e.g. firewall) that will be used to route traffic to the internet.')
+param networkApplianceIpAddress string
+
+@description('The size of the jump box virtual machine to create. See https://learn.microsoft.com/azure/virtual-machines/sizes for more information.')
+param vmSize string
+
+@description('Optional. The zone to create the jump box in. Defaults to 0.')
+param vmZone int = 0
+
+@description('Optional. The storage account type to use for the jump box. Defaults to Standard_LRS.')
+param storageAccountType string = 'Standard_LRS'
+
+@description('The username to use for the jump box.')
+param vmAdminUsername string
+
+@description('The password to use for the jump box.')
+@secure()
+param vmAdminPassword string
+
+@description('The SSH public key to use for the jump box. Only relevant for Linux.')
+@secure()
+param vmLinuxSshAuthorizedKey string
+
+@description('The OS of the jump box virtual machine to create. If set to "none", no jump box will be created.')
+@allowed(['linux', 'windows', 'none'])
+param vmJumpboxOSType string = 'none'
+
+@description('Optional. The name of the subnet to create for the jump box. If set, it overrides the name generated by the template.')
+param vmSubnetName string = 'snet-jumpbox'
+
+@description('CIDR to use for the jump box subnet.')
+param vmJumpBoxSubnetAddressPrefix string
+
+@description('Type of authentication to use on the Virtual Machine. SSH key is recommended.')
+@allowed([
+  'sshPublicKey'
+  'password'
+])
+param vmAuthenticationType string = 'password'
+
+// ------------------
+// VARIABLES
+// ------------------
+
+//Destination Service Tag for AzureCloud for Central France is centralfrance, but location is francecentral
+var locationVar = location == 'francecentral' ? 'centralfrance' : location
+var namingRules = json(loadTextContent('../naming/naming-rules.jsonc'))
+
+var rgSpokeName = !empty(spokeResourceGroupName)
+  ? spokeResourceGroupName
+  : '${namingRules.resourceTypeAbbreviations.resourceGroup}-${workloadName}-${environment}-${namingRules.regionAbbreviations[toLower(location)]}-spoke'
+
+// Subnet definition taking in consideration feature flags
+var defaultSubnets = [
+  {
+    name: spokeInfraSubnetName
+    addressPrefix: spokeInfraSubnetAddressPrefix
+    networkSecurityGroupResourceId: nsgContainerAppsEnvironment.outputs.resourceId
+    routeTableResourceId: (!empty(hubVNetId) && !empty(networkApplianceIpAddress))
+      ? egressLockdownUdr.outputs.resourceId
+      : null
+    delegations: [
+      {
+        name: 'envdelegation'
+        properties: {
+          serviceName: 'Microsoft.App/environments'
+        }
+      }
+    ]
+  }
+  {
+    name: spokePrivateEndpointsSubnetName
+    addressPrefix: spokePrivateEndpointsSubnetAddressPrefix
+    networkSecurityGroupResourceId: nsgPep.outputs.resourceId
+  }
+]
+
+// Append optional application gateway subnet, if required
+var appGwAndDefaultSubnets = !empty(spokeApplicationGatewaySubnetAddressPrefix)
+  ? concat(defaultSubnets, [
+      {
+        name: spokeApplicationGatewaySubnetName
+        addressPrefix: spokeApplicationGatewaySubnetAddressPrefix
+        networkSecurityGroupResourceId: nsgAppGw.outputs.resourceId
+      }
+    ])
+  : defaultSubnets
+
+//Append optional jumpbox subnet, if required
+var spokeSubnets = vmJumpboxOSType != 'none'
+  ? concat(appGwAndDefaultSubnets, [
+      {
+        name: vmSubnetName
+        addressPrefix: vmJumpBoxSubnetAddressPrefix
+      }
+    ])
+  : appGwAndDefaultSubnets
+
+// ------------------
+// RESOURCES
+// ------------------
+
+module spokeResourceGroup 'br/public:avm/res/resources/resource-group:0.2.3' = {
+  name: take('rg-${deployment().name}', 64)
+  params: {
+    name: rgSpokeName
+    location: location
+    enableTelemetry: enableTelemetry
+    tags: tags
+  }
+}
+
+@description('User-configured naming rules')
+module naming '../naming/naming.module.bicep' = {
+  scope: resourceGroup(rgSpokeName)
+  name: take('spokeNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(spokeResourceGroup.outputs.resourceId)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+@description('The spoke virtual network in which the workload will run from. This virtual network would normally already be provisioned by your subscription vending process, and only the subnets would need to be configured.')
+module vnetSpoke 'br/public:avm/res/network/virtual-network:0.1.6' = {
+  name: take('vnetSpoke-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    name: naming.outputs.resourcesNames.vnetSpoke
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    addressPrefixes: spokeVNetAddressPrefixes
+    subnets: spokeSubnets
+    peerings: (!empty(hubVNetId))
+      ? [
+          {
+            allowForwardedTraffic: true
+            allowGatewayTransit: false
+            allowVirtualNetworkAccess: true
+            remotePeeringAllowForwardedTraffic: true
+            remotePeeringAllowVirtualNetworkAccess: true
+            remotePeeringEnabled: true
+            remotePeeringName: 'spokeToHub'
+            remoteVirtualNetworkId: hubVNetId
+            useRemoteGateways: false
+          }
+        ]
+      : null
+  }
+}
+
+@description('The log sink for Azure Diagnostics')
+module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.3.4' = {
+  name: take('logAnalyticsWs-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    name: naming.outputs.resourcesNames.logAnalyticsWorkspace
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+@description('Network security group rules for the Container Apps cluster.')
+module nsgContainerAppsEnvironment 'br/public:avm/res/network/network-security-group:0.2.0' = {
+  name: take('nsgContainerAppsEnvironment-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    name: naming.outputs.resourcesNames.containerAppsEnvironmentNsg
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    securityRules: [
+      {
+        name: 'Allow_Internal_AKS_Connection_Between_Nodes_And_Control_Plane_UDP'
+        properties: {
+          description: 'internal AKS secure connection between underlying nodes and control plane..'
+          protocol: 'Udp'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'AzureCloud.${locationVar}'
+          destinationPortRange: '1194'
+          access: 'Allow'
+          priority: 100
+          direction: 'Outbound'
+        }
+      }
+      {
+        name: 'Allow_Internal_AKS_Connection_Between_Nodes_And_Control_Plane_TCP'
+        properties: {
+          description: 'internal AKS secure connection between underlying nodes and control plane..'
+          protocol: 'Tcp'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'AzureCloud.${locationVar}'
+          destinationPortRange: '9000'
+          access: 'Allow'
+          priority: 110
+          direction: 'Outbound'
+        }
+      }
+      {
+        name: 'Allow_Azure_Monitor'
+        properties: {
+          description: 'Allows outbound calls to Azure Monitor.'
+          protocol: 'Tcp'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'AzureCloud.${locationVar}'
+          destinationPortRange: '443'
+          access: 'Allow'
+          priority: 120
+          direction: 'Outbound'
+        }
+      }
+      {
+        name: 'Allow_Outbound_443'
+        properties: {
+          description: 'Allowing all outbound on port 443 provides a way to allow all FQDN based outbound dependencies that don\'t have a static IP'
+          protocol: 'Tcp'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '443'
+          access: 'Allow'
+          priority: 130
+          direction: 'Outbound'
+        }
+      }
+      {
+        name: 'Allow_NTP_Server'
+        properties: {
+          description: 'NTP server'
+          protocol: 'Udp'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '123'
+          access: 'Allow'
+          priority: 140
+          direction: 'Outbound'
+        }
+      }
+      {
+        name: 'Allow_Container_Apps_control_plane'
+        properties: {
+          description: 'Container Apps control plane'
+          protocol: 'Tcp'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRanges: [
+            '5671'
+            '5672'
+          ]
+          access: 'Allow'
+          priority: 150
+          direction: 'Outbound'
+        }
+      }
+      {
+        name: 'deny-hop-outbound'
+        properties: {
+          protocol: '*'
+          sourcePortRange: '*'
+          destinationPortRanges: [
+            '3389'
+            '22'
+          ]
+          access: 'Deny'
+          priority: 200
+          direction: 'Outbound'
+          sourceAddressPrefix: 'VirtualNetwork'
+          destinationAddressPrefix: '*'
+        }
+      }
+    ]
+    diagnosticSettings: [
+      {
+        name: 'logAnalyticsSettings'
+        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
+      }
+    ]
+  }
+}
+
+@description('NSG Rules for the Application Gateway.')
+module nsgAppGw 'br/public:avm/res/network/network-security-group:0.2.0' = if (!empty(spokeApplicationGatewaySubnetAddressPrefix)) {
+  name: take('nsgAppGw-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    name: naming.outputs.resourcesNames.applicationGatewayNsg
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    securityRules: [
+      {
+        name: 'HealthProbes'
+        properties: {
+          description: 'allow HealthProbes from gateway Manager.'
+          protocol: '*'
+          sourceAddressPrefix: 'GatewayManager'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '65200-65535'
+          access: 'Allow'
+          priority: 100
+          direction: 'Inbound'
+        }
+      }
+      {
+        name: 'Allow_TLS'
+        properties: {
+          description: 'allow https incoming connections'
+          protocol: '*'
+          sourceAddressPrefix: '*'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '443'
+          access: 'Allow'
+          priority: 110
+          direction: 'Inbound'
+        }
+      }
+      {
+        name: 'Allow_HTTP'
+        properties: {
+          description: 'allow http incoming connections'
+          protocol: '*'
+          sourceAddressPrefix: '*'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '80'
+          access: 'Allow'
+          priority: 120
+          direction: 'Inbound'
+        }
+      }
+      {
+        name: 'Allow_AzureLoadBalancer'
+        properties: {
+          description: 'allow AzureLoadBalancer incoming connections'
+          protocol: '*'
+          sourceAddressPrefix: 'AzureLoadBalancer'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '80'
+          access: 'Allow'
+          priority: 130
+          direction: 'Inbound'
+        }
+      }
+      {
+        name: 'allow-all-outbound'
+        properties: {
+          protocol: '*'
+          sourcePortRange: '*'
+          destinationPortRange: '*'
+          access: 'Allow'
+          priority: 210
+          direction: 'Outbound'
+          sourceAddressPrefix: 'VirtualNetwork'
+          destinationAddressPrefix: '*'
+        }
+      }
+    ]
+    diagnosticSettings: [
+      {
+        name: 'logAnalyticsSettings'
+        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
+      }
+    ]
+  }
+}
+
+@description('NSG Rules for the private enpoint subnet.')
+module nsgPep 'br/public:avm/res/network/network-security-group:0.2.0' = {
+  name: take('nsgPep-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    name: naming.outputs.resourcesNames.pepNsg
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    securityRules: [
+      {
+        name: 'deny-hop-outbound'
+        properties: {
+          protocol: '*'
+          sourcePortRange: '*'
+          destinationPortRanges: [
+            '3389'
+            '22'
+          ]
+          access: 'Deny'
+          priority: 200
+          direction: 'Outbound'
+          sourceAddressPrefix: 'VirtualNetwork'
+          destinationAddressPrefix: '*'
+        }
+      }
+    ]
+    diagnosticSettings: [
+      {
+        name: 'logAnalyticsSettings'
+        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
+      }
+    ]
+  }
+}
+
+@description('The Route Table deployment')
+module egressLockdownUdr 'br/public:avm/res/network/route-table:0.2.2' = if (!empty(hubVNetId) && !empty(networkApplianceIpAddress)) {
+  name: take('egressLockdownUdr-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    name: naming.outputs.resourcesNames.routeTable
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    routes: [
+      {
+        name: 'defaultEgressLockdown'
+        properties: {
+          addressPrefix: '0.0.0.0/0'
+          nextHopType: 'VirtualAppliance'
+          nextHopIpAddress: networkApplianceIpAddress
+        }
+      }
+    ]
+  }
+}
+
+@description('An optional Linux virtual machine deployment to act as a jump box.')
+module jumpboxLinuxVM '../compute/linux-vm.bicep' = if (vmJumpboxOSType == 'linux') {
+  name: take('vm-linux-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    vmName: naming.outputs.resourcesNames.vmJumpBox
+    bastionResourceId: bastionResourceId
+    vmAdminUsername: vmAdminUsername
+    vmAdminPassword: vmAdminPassword
+    vmSshPublicKey: vmLinuxSshAuthorizedKey
+    vmSize: vmSize
+    vmZone: vmZone
+    storageAccountType: storageAccountType
+    vmVnetName: vnetSpoke.outputs.name
+    vmSubnetName: vmSubnetName
+    vmSubnetAddressPrefix: vmJumpBoxSubnetAddressPrefix
+    vmNetworkInterfaceName: naming.outputs.resourcesNames.vmJumpBoxNic
+    vmNetworkSecurityGroupName: naming.outputs.resourcesNames.vmJumpBoxNsg
+    vmAuthenticationType: vmAuthenticationType
+    logAnalyticsWorkspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
+  }
+}
+
+@description('An optional Windows virtual machine deployment to act as a jump box.')
+module jumpboxWindowsVM '../compute/windows-vm.bicep' = if (vmJumpboxOSType == 'windows') {
+  name: take('vm-windows-${deployment().name}', 64)
+  scope: resourceGroup(rgSpokeName)
+  params: {
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    vmName: naming.outputs.resourcesNames.vmJumpBox
+    bastionResourceId: bastionResourceId
+    vmAdminUsername: vmAdminUsername
+    vmAdminPassword: vmAdminPassword
+    vmSize: vmSize
+    vmZone: vmZone
+    storageAccountType: storageAccountType
+    vmVnetName: vnetSpoke.outputs.name
+    vmSubnetName: vmSubnetName
+    vmSubnetAddressPrefix: vmJumpBoxSubnetAddressPrefix
+    vmNetworkInterfaceName: naming.outputs.resourcesNames.vmJumpBoxNic
+    vmNetworkSecurityGroupName: naming.outputs.resourcesNames.vmJumpBoxNsg
+    logAnalyticsWorkspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+resource vnetSpokeCreated 'Microsoft.Network/virtualNetworks@2022-07-01' existing = {
+  name: vnetSpoke.outputs.name
+  scope: resourceGroup(rgSpokeName)
+
+  resource spokeInfraSubnet 'subnets' existing = {
+    name: spokeInfraSubnetName
+  }
+
+  resource spokePrivateEndpointsSubnet 'subnets' existing = {
+    name: spokePrivateEndpointsSubnetName
+  }
+
+  resource spokeApplicationGatewaySubnet 'subnets' existing = if (!empty(spokeApplicationGatewaySubnetAddressPrefix)) {
+    name: spokeApplicationGatewaySubnetName
+  }
+}
+
+@description('The name of the spoke resource group.')
+output spokeResourceGroupName string = spokeResourceGroup.name
+
+@description('The resource ID of the spoke virtual network.')
+output spokeVNetId string = vnetSpokeCreated.id
+
+@description('The name of the spoke virtual network.')
+output spokeVNetName string = vnetSpokeCreated.name
+
+@description('The resource ID of the spoke infrastructure subnet.')
+output spokeInfraSubnetId string = vnetSpokeCreated::spokeInfraSubnet.id
+
+@description('The name of the spoke infrastructure subnet.')
+output spokeInfraSubnetName string = vnetSpokeCreated::spokeInfraSubnet.name
+
+@description('The name of the spoke private endpoints subnet.')
+output spokePrivateEndpointsSubnetName string = vnetSpokeCreated::spokePrivateEndpointsSubnet.name
+
+@description('The resource ID of the spoke Application Gateway subnet. This is \'\' if the subnet was not created.')
+output spokeApplicationGatewaySubnetId string = (!empty(spokeApplicationGatewaySubnetAddressPrefix))
+  ? vnetSpokeCreated::spokeApplicationGatewaySubnet.id
+  : ''
+
+@description('The name of the spoke Application Gateway subnet.  This is \'\' if the subnet was not created.')
+output spokeApplicationGatewaySubnetName string = (!empty(spokeApplicationGatewaySubnetAddressPrefix))
+  ? vnetSpokeCreated::spokeApplicationGatewaySubnet.name
+  : ''
+
+@description('The resource ID of the Azure Log Analytics Workspace.')
+output logAnalyticsWorkspaceId string = logAnalyticsWorkspace.outputs.resourceId
+
+@description('The name of the jump box virtual machine.')
+output vmJumpBoxName string = naming.outputs.resourcesNames.vmJumpBox
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/README.md b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/README.md
new file mode 100644
index 0000000000..730490c2b8
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/README.md
@@ -0,0 +1,51 @@
+# Deploy the long-lifecycle resources
+
+At this point, you have a spoke virtual network ready to land your workload into. However, workloads have resources that live on different lifecycle cadences. Here you'll be deploying the resources that have a lifecycle longer than any of your application platform components.
+
+## Expected results
+
+Workloads often have resources that exist on different lifecycles. Some are singletons, and not tied to the deployment stamp of the application platform. Others come and go with the application platform and are part of the application's stamp. Yet others might even be tied to the deployment of code within the application platform. In this deployment, you'll be deploying resources that are not expected to be tied to the same lifecycle as the instance of the Azure Container App, and are in fact dependencies for any given instance and could be used by multiple instances if you had multiple stamps.
+
+
+### Resources
+
+- Azure Container Registry
+- Azure Key Vault
+- Private Link for each, including related DNS Private Zone configuration
+- User managed identities for the workload
+
+By default, they are deployed to the spoke resource group.
+
+## Steps
+
+1. Create the regional resources that the Azure Container Apps platform and its applications will be dependant on.
+
+   ```bash
+   RESOURCEID_VNET_HUB=$(az deployment sub show -n acalza01-hub --query properties.outputs.hubVNetId.value -o tsv)
+   RESOURCENAME_RESOURCEGROUP_SPOKE=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.spokeResourceGroupName.value -o tsv)
+   RESOURCEID_VNET_SPOKE=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.spokeVNetId.value -o tsv)
+   LOG_ANALYTICS_WS_ID=$(az deployment sub show -n acalza01-spokenetwork --query properties.outputs.logAnalyticsWorkspaceId.value -o tsv)
+
+   echo RESOURCEID_VNET_HUB: $RESOURCEID_VNET_HUB && \
+   echo RESOURCENAME_RESOURCEGROUP_SPOKE: $RESOURCENAME_RESOURCEGROUP_SPOKE && \
+   echo RESOURCEID_VNET_SPOKE: $RESOURCEID_VNET_SPOKE  && \
+   echo LOG_ANALYTICS_WS_ID: $LOG_ANALYTICS_WS_ID
+
+   # [This takes about four minutes to run (if you add deployRedis=false).]
+   az deployment group create \
+      -n acalza01-dependencies \
+      -g $RESOURCENAME_RESOURCEGROUP_SPOKE \
+      -f 03-supporting-services/deploy.supporting-services.bicep \
+      -p 03-supporting-services/deploy.supporting-services.parameters.jsonc \
+      -p hubVNetId=${RESOURCEID_VNET_HUB} spokeVNetId=${RESOURCEID_VNET_SPOKE} \
+      -p logAnalyticsWorkspaceId=${LOG_ANALYTICS_WS_ID}
+   ```
+
+## Private DNS Zones
+
+Private DNS zones in this reference implementation are deployed at the hub level. For any resource that requires a private endpoint, the workload team (as part of the deployment of the LZA), will create the appropriate private DNS Zones & records, as well as the link to the Virtual Networks that need to resolve DNS names of the private Azure resources. The workload, in the LZA implementation, is using Azure DNS for resolution. Since this reference implementation is expected to be deployed isolated from existing infrastructure, Private DNS Zones are deployed in this way (in the hub, without Azure Policies etc), in order to resemple the recommendations of the CAF/ESLZ [Private Link and DNS integration at scale](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale), without over-complicating the Azure Container Apps LZA implementation.
+
+
+## Next step
+
+:arrow_forward: [Deploy Azure Container Apps environment](../04-container-apps-environment/README.md)
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/deploy.supporting-services.bicep b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/deploy.supporting-services.bicep
new file mode 100644
index 0000000000..a9518d2e06
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/deploy.supporting-services.bicep
@@ -0,0 +1,111 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long.')
+@maxLength(8)
+param environment string
+
+@description('The location where the resources will be created. This needs to be the same region as the spoke.')
+param location string = resourceGroup().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deployment telemetry.')
+param enableTelemetry bool
+
+// Hub
+@description('The resource ID of the existing hub virtual network.')
+param hubVNetId string
+
+// Spoke
+@description('The resource ID of the existing spoke virtual network to which the private endpoint will be connected.')
+param spokeVNetId string
+
+@description('The name of the existing subnet in the spoke virtual to which the private endpoint will be connected.')
+param spokePrivateEndpointSubnetName string
+
+@description('Optional. Resource ID of the diagnostic log analytics workspace. If left empty, no diagnostics settings will be defined.')
+param logAnalyticsWorkspaceId string = ''
+
+@description('Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false.')
+param deployZoneRedundantResources bool = true
+
+// ------------------
+// RESOURCES
+// ------------------
+
+@description('User-configured naming rules')
+module naming '../naming/naming.module.bicep' = {
+  name: take('supportingServicesNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(resourceGroup().id)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+@description('Azure Container Registry, where all workload images should be pulled from.')
+module containerRegistry 'modules/container-registry.module.bicep' = {
+  name: 'containerRegistryModule-${uniqueString(resourceGroup().id)}'
+  params: {
+    containerRegistryName: naming.outputs.resourcesNames.containerRegistry
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    spokeVNetId: spokeVNetId
+    hubVNetId: hubVNetId
+    spokePrivateEndpointSubnetName: spokePrivateEndpointSubnetName
+    containerRegistryPrivateEndpointName: naming.outputs.resourcesNames.containerRegistryPep
+    containerRegistryUserAssignedIdentityName: naming.outputs.resourcesNames.containerRegistryUserAssignedIdentity
+    diagnosticWorkspaceId: logAnalyticsWorkspaceId
+    deployZoneRedundantResources: deployZoneRedundantResources
+  }
+}
+
+@description('Azure Key Vault used to hold items like TLS certs and application secrets that your workload will need.')
+module keyVault 'modules/key-vault.bicep' = {
+  name: 'keyVault-${uniqueString(resourceGroup().id)}'
+  params: {
+    keyVaultName: naming.outputs.resourcesNames.keyVault
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    spokeVNetId: spokeVNetId
+    hubVNetId: hubVNetId
+    spokePrivateEndpointSubnetName: spokePrivateEndpointSubnetName
+    keyVaultPrivateEndpointName: naming.outputs.resourcesNames.keyVaultPep
+    diagnosticWorkspaceId: logAnalyticsWorkspaceId
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The resource ID of the Azure Container Registry.')
+output containerRegistryId string = containerRegistry.outputs.containerRegistryId
+
+@description('The name of the Azure Container Registry.')
+output containerRegistryName string = containerRegistry.outputs.containerRegistryName
+
+@description('The name of the container registry login server.')
+output containerRegistryLoginServer string = containerRegistry.outputs.containerRegistryLoginServer
+
+@description('The resource ID of the user-assigned managed identity for the Azure Container Registry to be able to pull images from it.')
+output containerRegistryUserAssignedIdentityId string = containerRegistry.outputs.containerRegistryUserAssignedIdentityId
+
+@description('The resource ID of the Azure Key Vault.')
+output keyVaultResourceId string = keyVault.outputs.keyVaultId
+
+@description('The name of the Azure Key Vault.')
+output keyVaultName string = keyVault.outputs.keyVaultName
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/modules/container-registry.module.bicep b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/modules/container-registry.module.bicep
new file mode 100644
index 0000000000..3168b3591b
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/modules/container-registry.module.bicep
@@ -0,0 +1,165 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The location where the resources will be created.')
+param location string = resourceGroup().location
+
+@description('The name of the container registry.')
+param containerRegistryName string
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+@description('Optional. The resource ID of the Hub Virtual Network.')
+param hubVNetId string = ''
+
+@description('The resource ID of the VNet to which the private endpoint will be connected.')
+param spokeVNetId string
+
+@description('The name of the subnet in the VNet to which the private endpoint will be connected.')
+param spokePrivateEndpointSubnetName string
+
+@description('Optional. The name of the private endpoint to be created for Azure Container Registry. If left empty, it defaults to "<resourceName>-pep')
+param containerRegistryPrivateEndpointName string = 'acr-pep'
+
+@description('The name of the user assigned identity to be created to pull image from Azure Container Registry.')
+param containerRegistryUserAssignedIdentityName string
+
+@description('Required. Resource ID of the diagnostic log analytics workspace.')
+param diagnosticWorkspaceId string
+
+@description('Optional, default value is true. If true, any resources that support AZ will be deployed in all three AZ. However if the selected region is not supporting AZ, this parameter needs to be set to false.')
+param deployZoneRedundantResources bool = true
+
+// ------------------
+// VARIABLES
+// ------------------
+
+var acrDnsZoneName = 'privatelink.azurecr.io'
+var spokeVNetIdTokens = split(spokeVNetId, '/')
+var spokeSubscriptionId = spokeVNetIdTokens[2]
+var spokeResourceGroupName = spokeVNetIdTokens[4]
+var spokeVNetName = spokeVNetIdTokens[8]
+var containerRegistryPullRoleGuid = '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+var virtualNetworkLinks = concat(
+  [
+    {
+      virtualNetworkResourceId: spokeVNetId
+      registrationEnabled: false
+    }
+  ],
+  (!empty(hubVNetId))
+    ? [
+        {
+          virtualNetworkResourceId: hubVNetId
+          registrationEnabled: false
+        }
+      ]
+    : []
+)
+// ------------------
+// RESOURCES
+// ------------------
+resource vnetSpoke 'Microsoft.Network/virtualNetworks@2022-01-01' existing = {
+  scope: resourceGroup(spokeSubscriptionId, spokeResourceGroupName)
+  name: spokeVNetName
+}
+
+resource spokePrivateEndpointSubnet 'Microsoft.Network/virtualNetworks/subnets@2022-07-01' existing = {
+  parent: vnetSpoke
+  name: spokePrivateEndpointSubnetName
+}
+
+module acrUserAssignedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.2.1' = {
+  name: containerRegistryUserAssignedIdentityName
+  params: {
+    name: containerRegistryUserAssignedIdentityName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+module acrdnszone 'br/public:avm/res/network/private-dns-zone:0.3.0' = {
+  name: 'acrDnsZoneDeployment-${uniqueString(resourceGroup().id)}'
+  params: {
+    name: acrDnsZoneName
+    location: 'global'
+    tags: tags
+    enableTelemetry: enableTelemetry
+    virtualNetworkLinks: virtualNetworkLinks
+  }
+}
+
+module acr 'br/public:avm/res/container-registry/registry:0.3.0' = {
+  name: 'containerRegistry-${uniqueString(resourceGroup().id)}'
+  params: {
+    name: containerRegistryName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    acrSku: 'Premium'
+    publicNetworkAccess: 'Disabled'
+    acrAdminUserEnabled: false
+    networkRuleBypassOptions: 'AzureServices'
+    zoneRedundancy: deployZoneRedundantResources ? 'Enabled' : 'Disabled'
+    trustPolicyStatus: 'enabled'
+    diagnosticSettings: [
+      {
+        name: 'acr-log-analytics'
+        logCategoriesAndGroups: [
+          {
+            categoryGroup: 'allLogs'
+          }
+        ]
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+          }
+        ]
+        workspaceResourceId: diagnosticWorkspaceId
+      }
+    ]
+    privateEndpoints: [
+      {
+        name: containerRegistryPrivateEndpointName
+        privateDnsZoneResourceIds: [
+          acrdnszone.outputs.resourceId
+        ]
+        subnetResourceId: spokePrivateEndpointSubnet.id
+      }
+    ]
+    quarantinePolicyStatus: 'enabled'
+    roleAssignments: [
+      {
+        principalId: acrUserAssignedIdentity.outputs.principalId
+        principalType: 'ServicePrincipal'
+        roleDefinitionIdOrName: containerRegistryPullRoleGuid
+      }
+    ]
+    softDeletePolicyDays: 7
+    softDeletePolicyStatus: 'disabled'
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The resource ID of the container registry.')
+output containerRegistryId string = acr.outputs.resourceId
+
+@description('The name of the container registry.')
+output containerRegistryName string = acr.outputs.name
+
+@description('The name of the container registry login server.')
+output containerRegistryLoginServer string = acr.outputs.loginServer
+
+@description('The resource ID of the user assigned managed identity for the container registry to be able to pull images from it.')
+output containerRegistryUserAssignedIdentityId string = acrUserAssignedIdentity.outputs.resourceId
diff --git a/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/modules/key-vault.bicep b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/modules/key-vault.bicep
new file mode 100644
index 0000000000..97a03c2c6f
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/modules/supporting-services/modules/key-vault.bicep
@@ -0,0 +1,139 @@
+targetScope = 'resourceGroup'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The location where the resources will be created.')
+param location string = resourceGroup().location
+
+@description('The name of the Key Vault.')
+param keyVaultName string
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+@description('The resource ID of the Hub Virtual Network.')
+param hubVNetId string
+
+@description('The resource ID of the VNet to which the private endpoint will be connected.')
+param spokeVNetId string
+
+@description('The name of the subnet in the VNet to which the private endpoint will be connected.')
+param spokePrivateEndpointSubnetName string
+
+@description('Optional. The name of the private endpoint to be created for Key Vault. If left empty, it defaults to "<resourceName>-pep')
+param keyVaultPrivateEndpointName string = 'keyvault-pep'
+
+@description('Required. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace.')
+param diagnosticWorkspaceId string
+
+@description('Optional. The name of the diagnostic setting, if deployed. If left empty, it defaults to "<resourceName>-diagnosticSettings".')
+param diagnosticSettingsName string = 'keyvault-diagnosticSettings'
+
+// ------------------
+// VARIABLES
+// ------------------
+
+var vaultDnsZoneName = 'privatelink.vaultcore.azure.net'
+var spokeVNetIdTokens = split(spokeVNetId, '/')
+var spokeSubscriptionId = spokeVNetIdTokens[2]
+var spokeResourceGroupName = spokeVNetIdTokens[4]
+var spokeVNetName = spokeVNetIdTokens[8]
+var virtualNetworkLinks = concat(
+  [
+    {
+      virtualNetworkResourceId: spokeVNetId
+      registrationEnabled: false
+    }
+  ],
+  (!empty(hubVNetId))
+    ? [
+        {
+          virtualNetworkResourceId: hubVNetId
+          registrationEnabled: false
+        }
+      ]
+    : []
+)
+// ------------------
+// RESOURCES
+// ------------------
+
+resource vnetSpoke 'Microsoft.Network/virtualNetworks@2022-01-01' existing = {
+  scope: resourceGroup(spokeSubscriptionId, spokeResourceGroupName)
+  name: spokeVNetName
+}
+
+resource spokePrivateEndpointSubnet 'Microsoft.Network/virtualNetworks/subnets@2022-07-01' existing = {
+  parent: vnetSpoke
+  name: spokePrivateEndpointSubnetName
+}
+
+module vaultdnszone 'br/public:avm/res/network/private-dns-zone:0.3.0' = {
+  name: 'keyvaultDnsZoneDeployment-${uniqueString(resourceGroup().id)}'
+  params: {
+    name: vaultDnsZoneName
+    location: 'global'
+    tags: tags
+    enableTelemetry: enableTelemetry
+    virtualNetworkLinks: virtualNetworkLinks
+  }
+}
+
+module keyvault 'br/public:avm/res/key-vault/vault:0.6.1' = {
+  name: 'vault-${uniqueString(resourceGroup().id)}'
+  params: {
+    name: keyVaultName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    sku: 'standard'
+    networkAcls: {
+      bypass: 'AzureServices'
+      defaultAction: 'Deny'
+    }
+    enableSoftDelete: true
+    softDeleteRetentionInDays: 7
+    enablePurgeProtection: null
+    publicNetworkAccess: 'Disabled'
+    enableRbacAuthorization: true
+    enableVaultForDeployment: true
+    privateEndpoints: [
+      {
+        name: keyVaultPrivateEndpointName
+        privateDnsZoneResourceIds: [
+          vaultdnszone.outputs.resourceId
+        ]
+        subnetResourceId: spokePrivateEndpointSubnet.id
+      }
+    ]
+    diagnosticSettings: [
+      {
+        name: diagnosticSettingsName
+        workspaceResourceId: diagnosticWorkspaceId
+        logCategoriesAndGroups: [
+          { categoryGroup: 'allLogs' }
+        ]
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+          }
+        ]
+      }
+    ]
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The resource ID of the key vault.')
+output keyVaultId string = keyvault.outputs.resourceId
+
+@description('The name of the key vault.')
+output keyVaultName string = keyvault.outputs.name
diff --git a/avm/ptn/aca-lza/hosting-environment/tests/e2e/defaults/main.test.bicep b/avm/ptn/aca-lza/hosting-environment/tests/e2e/defaults/main.test.bicep
new file mode 100644
index 0000000000..e23cf90aa2
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/tests/e2e/defaults/main.test.bicep
@@ -0,0 +1,54 @@
+metadata name = 'Using only defaults.'
+metadata description = 'This instance deploys the module with the minimum set of required parameters.'
+
+targetScope = 'subscription'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'acalzamin'
+
+@description('Optional. Test name prefix.')
+param namePrefix string = '#_namePrefix_#'
+
+@description('Optional. The password to leverage for the login.')
+@secure()
+param password string = newGuid()
+
+// ============== //
+// Test Execution //
+// ============== //
+
+module testDeployment '../../../main.bicep' = {
+  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
+  params: {
+    workloadName: serviceShort
+    tags: {
+      environment: 'test'
+    }
+    location: resourceLocation
+    vmSize: 'Standard_B1s'
+    vmAdminUsername: 'vmadmin'
+    vmAdminPassword: password
+    vmLinuxSshAuthorizedKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain'
+    vmAuthenticationType: 'sshPublicKey'
+    vmJumpboxOSType: 'linux'
+    vmJumpBoxSubnetAddressPrefix: '10.1.2.32/27'
+    spokeVNetAddressPrefixes: [
+      '10.1.0.0/22'
+    ]
+    spokeInfraSubnetAddressPrefix: '10.1.0.0/23'
+    spokePrivateEndpointsSubnetAddressPrefix: '10.1.2.0/27'
+    spokeApplicationGatewaySubnetAddressPrefix: '10.1.3.0/24'
+    enableApplicationInsights: true
+    enableDaprInstrumentation: false
+    applicationGatewayCertificateKeyName: 'appgwcert'
+  }
+}
+
+output testDeploymentOutputs object = testDeployment.outputs
diff --git a/avm/ptn/aca-lza/hosting-environment/tests/e2e/hub-spoke/deploy.hub.bicep b/avm/ptn/aca-lza/hosting-environment/tests/e2e/hub-spoke/deploy.hub.bicep
new file mode 100644
index 0000000000..d10701bf29
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/tests/e2e/hub-spoke/deploy.hub.bicep
@@ -0,0 +1,476 @@
+targetScope = 'subscription'
+
+// ------------------
+//    PARAMETERS
+// ------------------
+
+@description('The name of the workload that is being deployed. Up to 10 characters long.')
+@minLength(2)
+@maxLength(10)
+param workloadName string
+
+@description('The name of the environment (e.g. "dev", "test", "prod", "uat", "dr", "qa"). Up to 8 characters long.')
+@maxLength(8)
+param environment string = 'test'
+
+@description('The location where the resources will be created.')
+param location string = deployment().location
+
+@description('Optional. The tags to be assigned to the created resources.')
+param tags object = {}
+
+@description('Required. Whether to enable deplotment telemetry.')
+param enableTelemetry bool
+
+@description('CIDR of the hub virtual network.')
+param vnetAddressPrefixes array
+
+@description('Enable or disable the creation of the Azure Bastion.')
+param enableBastion bool = true
+
+@description('Bastion sku, default is basic')
+@allowed([
+  'Basic'
+  'Standard'
+])
+param bastionSku string = 'Basic'
+
+@description('CIDR to use for the Azure Bastion subnet.')
+param bastionSubnetAddressPrefix string
+
+@description('CIDR to use for the gatewaySubnet.')
+param gatewaySubnetAddressPrefix string
+
+@description('CIDR to use for the azureFirewallSubnet.')
+param azureFirewallSubnetAddressPrefix string
+
+//@description('CIDR to use for the AzureFirewallManagementSubnet, which is required by AzFW Basic.')
+//param azureFirewallSubnetManagementAddressPrefix string
+
+// ------------------
+// VARIABLES
+// ------------------
+
+// These cannot be another value
+var gatewaySubnetName = 'GatewaySubnet'
+var azureFirewallSubnetName = 'AzureFirewallSubnet'
+//var AzureFirewallManagementSubnetName = 'AzureFirewallManagementSubnet'
+var bastionSubnetName = 'AzureBastionSubnet'
+
+//Subnet definition taking in consideration feature flags
+var defaultSubnets = [
+  {
+    name: gatewaySubnetName
+    addressPrefix: gatewaySubnetAddressPrefix
+  }
+  {
+    name: azureFirewallSubnetName
+    addressPrefix: azureFirewallSubnetAddressPrefix
+  }
+  // {
+  //   name: AzureFirewallManagementSubnetName
+  //   addressPrefix: azureFirewallSubnetManagementAddressPrefix
+  // }
+]
+
+// Append optional bastion subnet, if required
+var vnetSubnets = enableBastion
+  ? concat(defaultSubnets, [
+      {
+        name: bastionSubnetName
+        addressPrefix: bastionSubnetAddressPrefix
+      }
+    ])
+  : defaultSubnets
+
+//used only to override the RG name - because it is created at the subscription level, the naming module cannot be loaded/used
+var namingRules = json(loadTextContent('../../../modules/naming/naming-rules.jsonc'))
+var rgHubName = '${namingRules.resourceTypeAbbreviations.resourceGroup}-${workloadName}-hub-${environment}-${namingRules.regionAbbreviations[toLower(location)]}'
+var spokeInfraSubnetAddressPrefix = '10.1.0.0/23'
+var applicationRuleCollections = [
+  {
+    name: 'ace-allow-rules'
+    properties: {
+      action: {
+        type: 'Allow'
+      }
+      priority: 110
+      rules: [
+        {
+          name: 'ace-general-allow-rules'
+          protocols: [
+            {
+              port: 80
+              protocolType: 'Http'
+            }
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          targetFqdns: [
+            'mcr.microsoft.com'
+            '*.data.mcr.microsoft.com'
+            '*.blob.${az.environment().suffixes.storage}' //NOTE: If you use ACR the endpoint must be added as well.
+          ]
+        }
+        {
+          name: 'ace-acr-and-docker-allow-rules'
+          protocols: [
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          targetFqdns: [
+            '*.blob.${az.environment().suffixes.storage}'
+            'login.microsoft.com'
+            '*.azurecr.io' //NOTE: for less permisive environment replace wildcard with actual(s) Container Registries
+            'hub.docker.com'
+            'registry-1.docker.io'
+            'production.cloudflare.docker.com'
+          ]
+        }
+        {
+          name: 'ace-managed-identity-allow-rules'
+          protocols: [
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          targetFqdns: [
+            '*.identity.azure.net'
+            'login.microsoftonline.com'
+            '*.login.microsoftonline.com'
+            '*.login.microsoft.com'
+          ]
+        }
+        {
+          name: 'ace-keyvault-allow-rules'
+          protocols: [
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          targetFqdns: [
+            '*${az.environment().suffixes.keyvaultDns}' //NOTE: for less permisive environment replace wildcard with actual(s) KeyVault
+            #disable-next-line no-hardcoded-env-urls
+            'login.microsoft.com'
+          ]
+        }
+      ]
+    }
+  }
+  {
+    name: 'allow_azure_monitor'
+    properties: {
+      action: {
+        type: 'Allow'
+      }
+      priority: 120
+      rules: [
+        {
+          fqdnTags: []
+          targetFqdns: [
+            'dc.applicationinsights.azure.com'
+            'dc.applicationinsights.microsoft.com'
+            'dc.services.visualstudio.com'
+            '*.in.applicationinsights.azure.com'
+            'live.applicationinsights.azure.com'
+            'rt.applicationinsights.microsoft.com'
+            'rt.services.visualstudio.com'
+            '*.livediagnostics.monitor.azure.com'
+            '*.monitoring.azure.com'
+            'agent.azureserviceprofiler.net'
+            '*.agent.azureserviceprofiler.net'
+            '*.monitor.azure.com'
+          ]
+          name: 'allow-azure-monitor'
+          protocols: [
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+        }
+      ]
+    }
+  }
+  {
+    name: 'allow_core_dev_fqdn' //NOTE: This rule is optional, and used here only to demonstrate that there are possibly more fqdns that need to be allowed, depending on your scenario
+    properties: {
+      action: {
+        type: 'Allow'
+      }
+      priority: 130
+      rules: [
+        {
+          name: 'allow-developer-services'
+          fqdnTags: []
+          targetFqdns: [
+            'github.com'
+            '*.github.com'
+            'ghcr.io'
+            '*.ghcr.io'
+            '*.nuget.org'
+            '*.blob.${az.environment().suffixes.storage}' // might replace wildcard with specific FQDN
+            '*.table.${az.environment().suffixes.storage}' // might replace wildcard with specific FQDN
+            '*.servicebus.windows.net' // might replace wildcard with specific FQDN
+            'githubusercontent.com'
+            '*.githubusercontent.com'
+            'dev.azure.com'
+            'portal.azure.com'
+            '*.portal.azure.com'
+            '*.portal.azure.net'
+            'appservice.azureedge.net'
+            '*.azurewebsites.net'
+          ]
+          protocols: [
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+        }
+        {
+          name: 'allow-certificate-dependencies'
+          fqdnTags: []
+          targetFqdns: [
+            '*.delivery.mp.microsoft.com'
+            'ctldl.windowsupdate.com'
+            'ocsp.msocsp.com'
+            'oneocsp.microsoft.com'
+            'crl.microsoft.com'
+            'www.microsoft.com'
+            '*.digicert.com'
+            '*.symantec.com'
+            '*.symcb.com'
+            '*.d-trust.net'
+          ]
+          protocols: [
+            {
+              port: 80
+              protocolType: 'Http'
+            }
+            {
+              port: 443
+              protocolType: 'Https'
+            }
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+        }
+      ]
+    }
+  }
+]
+var networkRules = [
+  {
+    name: 'ace-allow-rules'
+    properties: {
+      action: {
+        type: 'Allow'
+      }
+      priority: 100
+      // For more  Azure resources (than KeyVault, ACR etc which we use here) you are using with Azure Firewall,
+      // please refer to the service tags documentation: https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags
+      rules: [
+        {
+          name: 'ace-general-allow-rule'
+          protocols: [
+            'Any'
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          destinationAddresses: [
+            'MicrosoftContainerRegistry' //For even less permisive environment, you can point to a specific MCR region, i.e. 'MicrosoftContainerRegistry.Westeurope'
+            'AzureFrontDoor.FirstParty'
+          ]
+          destinationPorts: [
+            '443'
+          ]
+        }
+        {
+          name: 'ace-acr-allow-rule'
+          protocols: [
+            'Any'
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          destinationAddresses: [
+            'AzureContainerRegistry' //For even less permisive environment, you can point to a specific ACR region, i.e. 'MicrosoftContainerRegistry.Westeurope'
+            'AzureActiveDirectory'
+          ]
+          destinationPorts: [
+            '443'
+          ]
+        }
+        {
+          name: 'ace-keyvault-allow-rule'
+          protocols: [
+            'Any'
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          destinationAddresses: [
+            'AzureKeyVault' //For even less permisive environment, you can point to a specific keyvault region, i.e. 'MicrosoftContainerRegistry.Westeurope'
+            'AzureActiveDirectory'
+          ]
+          destinationPorts: [
+            '443'
+          ]
+        }
+        {
+          name: 'ace-managedIdentity-allow-rule'
+          protocols: [
+            'Any'
+          ]
+          sourceAddresses: [
+            spokeInfraSubnetAddressPrefix
+          ]
+          destinationAddresses: [
+            'AzureActiveDirectory'
+          ]
+          destinationPorts: [
+            '443'
+          ]
+        }
+      ]
+    }
+  }
+]
+// ------------------
+// RESOURCES
+// ------------------
+@description('User-configured naming rules')
+module naming '../../../modules/naming/naming.module.bicep' = {
+  scope: resourceGroup(rgHubName)
+  name: take('hubNamingDeployment-${deployment().name}', 64)
+  params: {
+    uniqueId: uniqueString(hubResourceGroup.outputs.resourceId)
+    environment: environment
+    workloadName: workloadName
+    location: location
+  }
+}
+
+@description('The hub resource group. This would normally be already provisioned by your platform team.')
+module hubResourceGroup 'br/public:avm/res/resources/resource-group:0.2.3' = {
+  name: take('rg-${deployment().name}', 64)
+  params: {
+    name: rgHubName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+@description('The log sink for Azure Diagnostics')
+module hubLogAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.3.4' = {
+  name: take('logAnalyticsWs-${uniqueString(rgHubName)}', 64)
+  scope: resourceGroup(rgHubName)
+  params: {
+    name: naming.outputs.resourcesNames.logAnalyticsWorkspace
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+@description('The virtual network used as the stand-in for the regional hub. This would normally be already provisioned by your platform team.')
+module vnetHub 'br/public:avm/res/network/virtual-network:0.1.6' = {
+  name: take('vnetHub-${deployment().name}', 64)
+  scope: resourceGroup(rgHubName)
+  params: {
+    name: naming.outputs.resourcesNames.vnetHub
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    addressPrefixes: vnetAddressPrefixes
+    subnets: vnetSubnets
+  }
+}
+
+@description('The Azure Firewall deployment. This would normally be already provisioned by your platform team.')
+module azureFirewall 'br/public:avm/res/network/azure-firewall:0.3.2' = {
+  name: take('afw-${deployment().name}', 64)
+  scope: resourceGroup(rgHubName)
+  params: {
+    name: naming.outputs.resourcesNames.azureFirewall
+    azureSkuTier: 'Standard'
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    virtualNetworkResourceId: vnetHub.outputs.resourceId
+    applicationRuleCollections: applicationRuleCollections
+    networkRuleCollections: networkRules
+    diagnosticSettings: [
+      {
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+          }
+        ]
+        name: 'azfw-diag'
+        workspaceResourceId: hubLogAnalyticsWorkspace.outputs.resourceId
+      }
+    ]
+  }
+}
+
+@description('An optional Azure Bastion deployment for jump box access. This would normally be already provisioned by your platform team.')
+module bastionHost 'br/public:avm/res/network/bastion-host:0.2.1' = {
+  name: take('bastion-${deployment().name}', 64)
+  scope: resourceGroup(rgHubName)
+  params: {
+    // Required parameters
+    name: naming.outputs.resourcesNames.bastion
+    virtualNetworkResourceId: vnetHub.outputs.resourceId
+    // Non-required parameters
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    enableFileCopy: true
+    skuName: bastionSku
+  }
+}
+
+// ------------------
+// OUTPUTS
+// ------------------
+
+@description('The resource ID of hub virtual network.')
+output hubVNetId string = vnetHub.outputs.resourceId
+
+@description('The name of hub virtual network')
+output hubVnetName string = vnetHub.outputs.name
+
+@description('The name of the hub resource group.')
+output resourceGroupName string = hubResourceGroup.outputs.name
+
+@description('The private IP address of the Azure Firewall.')
+output networkApplianceIpAddress string = azureFirewall.outputs.privateIp
diff --git a/avm/ptn/aca-lza/hosting-environment/tests/e2e/hub-spoke/main.test.bicep b/avm/ptn/aca-lza/hosting-environment/tests/e2e/hub-spoke/main.test.bicep
new file mode 100644
index 0000000000..f0edb1d3d0
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/tests/e2e/hub-spoke/main.test.bicep
@@ -0,0 +1,84 @@
+metadata name = 'Using a hub and spoke deployment.'
+metadata description = 'This instance deploys the module including a Hub to peer to.'
+
+targetScope = 'subscription'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'hubspoke'
+
+@description('Optional. Test name prefix.')
+param namePrefix string = '#_namePrefix_#'
+
+@description('Optional. The password to leverage for the login.')
+@secure()
+param password string = newGuid()
+
+// ================= //
+// Variables Section //
+// ================= //
+
+// ============ //
+// Dependencies //
+// ============ //
+module hubdeployment 'deploy.hub.bicep' = {
+  name: '${uniqueString(deployment().name, resourceLocation)}-hub-${serviceShort}'
+  params: {
+    location: resourceLocation
+    tags: {
+      environment: 'test'
+    }
+    enableTelemetry: true
+    vnetAddressPrefixes: ['10.0.0.0/24']
+    azureFirewallSubnetAddressPrefix: '10.0.0.64/26'
+    //azureFirewallSubnetManagementAddressPrefix: '10.0.0.128/26'
+    gatewaySubnetAddressPrefix: '10.0.0.0/27'
+    bastionSubnetAddressPrefix: '10.0.0.192/26'
+    workloadName: serviceShort
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+module testDeployment '../../../main.bicep' = {
+  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
+  params: {
+    workloadName: serviceShort
+    hubVirtualNetworkResourceId: hubdeployment.outputs.hubVNetId
+    networkApplianceIpAddress: hubdeployment.outputs.networkApplianceIpAddress
+    tags: {
+      environment: 'test'
+    }
+    environment: 'dev'
+    location: resourceLocation
+    vmSize: 'Standard_B1s'
+    storageAccountType: 'Premium_LRS'
+    vmAdminUsername: 'vmadmin'
+    vmAdminPassword: password
+    vmLinuxSshAuthorizedKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain'
+    vmAuthenticationType: 'sshPublicKey'
+    vmJumpboxOSType: 'linux'
+    vmJumpBoxSubnetAddressPrefix: '10.1.2.32/27'
+    spokeVNetAddressPrefixes: [
+      '10.1.0.0/22'
+    ]
+    spokeInfraSubnetAddressPrefix: '10.1.0.0/23'
+    spokePrivateEndpointsSubnetAddressPrefix: '10.1.2.0/27'
+    spokeApplicationGatewaySubnetAddressPrefix: '10.1.3.0/24'
+    enableApplicationInsights: true
+    enableDaprInstrumentation: false
+    applicationGatewayCertificateKeyName: 'appgwcert'
+    deployZoneRedundantResources: true
+    exposeContainerAppsWith: 'applicationGateway'
+    enableDdosProtection: true
+  }
+}
+
+output testDeploymentOutputs object = testDeployment.outputs
diff --git a/avm/ptn/aca-lza/hosting-environment/tests/e2e/waf-aligned/main.test.bicep b/avm/ptn/aca-lza/hosting-environment/tests/e2e/waf-aligned/main.test.bicep
new file mode 100644
index 0000000000..56da49fa5f
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/tests/e2e/waf-aligned/main.test.bicep
@@ -0,0 +1,59 @@
+metadata name = 'Using all the available options in WAF aligned values.'
+metadata description = 'This instance deploys the module with the all the available parameters in WAF aligned values.'
+
+targetScope = 'subscription'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+// e.g., for a module 'network/private-endpoint' you could use 'npe' as a prefix and then 'waf' as a suffix for the waf-aligned test
+param serviceShort string = 'acawaf'
+
+@description('Optional. Test name prefix.')
+param namePrefix string = '#_namePrefix_#'
+
+@description('Optional. The password to leverage for the login.')
+@secure()
+param password string = newGuid()
+
+// ============== //
+// Test Execution //
+// ============== //
+module testDeployment '../../../main.bicep' = {
+  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
+  params: {
+    workloadName: serviceShort
+    tags: {
+      environment: 'test'
+    }
+    environment: 'dev'
+    location: resourceLocation
+    vmSize: 'Standard_B1s'
+    storageAccountType: 'Premium_LRS'
+    vmAdminUsername: 'vmadmin'
+    vmAdminPassword: password
+    vmLinuxSshAuthorizedKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9QWdPia7CYYWWX/+eRrLKzGtQ+tjelZfDlbHy/Dg98 konstantinospantos@KonstaninossMBP.localdomain'
+    vmAuthenticationType: 'sshPublicKey'
+    vmJumpboxOSType: 'linux'
+    vmJumpBoxSubnetAddressPrefix: '10.1.2.32/27'
+    spokeVNetAddressPrefixes: [
+      '10.1.0.0/22'
+    ]
+    spokeInfraSubnetAddressPrefix: '10.1.0.0/23'
+    spokePrivateEndpointsSubnetAddressPrefix: '10.1.2.0/27'
+    spokeApplicationGatewaySubnetAddressPrefix: '10.1.3.0/24'
+    enableApplicationInsights: true
+    enableDaprInstrumentation: false
+    applicationGatewayCertificateKeyName: 'appgwcert'
+    deployZoneRedundantResources: true
+    exposeContainerAppsWith: 'applicationGateway'
+    enableDdosProtection: true
+  }
+}
+
+output testDeploymentOutputs object = testDeployment.outputs
diff --git a/avm/ptn/aca-lza/hosting-environment/version.json b/avm/ptn/aca-lza/hosting-environment/version.json
new file mode 100644
index 0000000000..8def869ede
--- /dev/null
+++ b/avm/ptn/aca-lza/hosting-environment/version.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
+  "version": "0.1",
+  "pathFilters": [
+    "./main.json"
+  ]
+}
diff --git a/avm/ptn/ai-platform/baseline/README.md b/avm/ptn/ai-platform/baseline/README.md
index de84a7d9bb..6f00abf4fa 100644
--- a/avm/ptn/ai-platform/baseline/README.md
+++ b/avm/ptn/ai-platform/baseline/README.md
@@ -19,10 +19,15 @@ By integrating with Microsoft Entra ID for secure identity management and utiliz
 | :-- | :-- |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
+| `Microsoft.Automanage/configurationProfileAssignments` | [2022-05-04](https://learn.microsoft.com/en-us/azure/templates) |
+| `Microsoft.Compute/virtualMachines` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2023-09-01/virtualMachines) |
+| `Microsoft.Compute/virtualMachines/extensions` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2022-11-01/virtualMachines/extensions) |
 | `Microsoft.ContainerRegistry/registries` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries) |
 | `Microsoft.ContainerRegistry/registries/cacheRules` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/cacheRules) |
 | `Microsoft.ContainerRegistry/registries/replications` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/replications) |
 | `Microsoft.ContainerRegistry/registries/webhooks` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/webhooks) |
+| `Microsoft.DevTestLab/schedules` | [2018-09-15](https://learn.microsoft.com/en-us/azure/templates/Microsoft.DevTestLab/2018-09-15/schedules) |
+| `Microsoft.GuestConfiguration/guestConfigurationAssignments` | [2020-06-25](https://learn.microsoft.com/en-us/azure/templates/Microsoft.GuestConfiguration/2020-06-25/guestConfigurationAssignments) |
 | `Microsoft.Insights/components` | [2020-02-02](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2020-02-02/components) |
 | `microsoft.insights/components/linkedStorageAccounts` | [2020-03-01-preview](https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/2020-03-01-preview/components/linkedStorageAccounts) |
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
@@ -32,10 +37,30 @@ By integrating with Microsoft Entra ID for secure identity management and utiliz
 | `Microsoft.KeyVault/vaults/secrets` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/secrets) |
 | `Microsoft.MachineLearningServices/workspaces` | [2024-04-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.MachineLearningServices/2024-04-01-preview/workspaces) |
 | `Microsoft.MachineLearningServices/workspaces/computes` | [2022-10-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.MachineLearningServices/2022-10-01/workspaces/computes) |
+| `Microsoft.Maintenance/configurationAssignments` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Maintenance/2023-04-01/configurationAssignments) |
 | `Microsoft.ManagedIdentity/userAssignedIdentities` | [2023-01-31](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2023-01-31/userAssignedIdentities) |
+| `Microsoft.Network/bastionHosts` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-11-01/bastionHosts) |
+| `Microsoft.Network/networkInterfaces` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkInterfaces) |
+| `Microsoft.Network/networkSecurityGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/networkSecurityGroups) |
+| `Microsoft.Network/privateDnsZones` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones) |
+| `Microsoft.Network/privateDnsZones/A` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/A) |
+| `Microsoft.Network/privateDnsZones/AAAA` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/AAAA) |
+| `Microsoft.Network/privateDnsZones/CNAME` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/CNAME) |
+| `Microsoft.Network/privateDnsZones/MX` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/MX) |
+| `Microsoft.Network/privateDnsZones/PTR` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/PTR) |
+| `Microsoft.Network/privateDnsZones/SOA` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/SOA) |
+| `Microsoft.Network/privateDnsZones/SRV` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/SRV) |
+| `Microsoft.Network/privateDnsZones/TXT` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/TXT) |
+| `Microsoft.Network/privateDnsZones/virtualNetworkLinks` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/virtualNetworkLinks) |
+| `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
 | `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
 | `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/publicIPAddresses` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-09-01/publicIPAddresses) |
+| `Microsoft.Network/virtualNetworks` | [2024-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/virtualNetworks) |
+| `Microsoft.Network/virtualNetworks/subnets` | [2024-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/virtualNetworks/subnets) |
 | `Microsoft.OperationalInsights/workspaces` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2023-09-01/workspaces) |
+| `Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems` | [2023-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.RecoveryServices/2023-01-01/vaults/backupFabrics/protectionContainers/protectedItems) |
 | `Microsoft.Storage/storageAccounts` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Storage/2022-09-01/storageAccounts) |
 | `Microsoft.Storage/storageAccounts/blobServices` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Storage/2022-09-01/storageAccounts/blobServices) |
 | `Microsoft.Storage/storageAccounts/blobServices/containers` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Storage/2022-09-01/storageAccounts/blobServices/containers) |
@@ -59,7 +84,9 @@ The following section provides usage examples for the module, which were used to
 
 - [Using only defaults](#example-1-using-only-defaults)
 - [Using large parameter set](#example-2-using-large-parameter-set)
-- [WAF-aligned](#example-3-waf-aligned)
+- [Without virtual machine](#example-3-without-virtual-machine)
+- [Without virtual network](#example-4-without-virtual-network)
+- [WAF-aligned](#example-5-waf-aligned)
 
 ### Example 1: _Using only defaults_
 
@@ -74,7 +101,13 @@ This instance deploys the module with the minimum set of required parameters.
 module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
   name: 'baselineDeployment'
   params: {
+    // Required parameters
     name: '<name>'
+    // Non-required parameters
+    virtualMachineConfiguration: {
+      adminPassword: '<adminPassword>'
+      adminUsername: 'localAdminUser'
+    }
   }
 }
 ```
@@ -91,8 +124,16 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
   "contentVersion": "1.0.0.0",
   "parameters": {
+    // Required parameters
     "name": {
       "value": "<name>"
+    },
+    // Non-required parameters
+    "virtualMachineConfiguration": {
+      "value": {
+        "adminPassword": "<adminPassword>",
+        "adminUsername": "localAdminUser"
+      }
     }
   }
 }
@@ -117,29 +158,88 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
     // Required parameters
     name: 'aipbmax'
     // Non-required parameters
-    applicationInsightsSettings: {
+    applicationInsightsConfiguration: {
       name: 'appi-aipbmax'
     }
-    containerRegistrySettings: {
+    bastionConfiguration: {
+      disableCopyPaste: true
+      enabled: true
+      enableFileCopy: true
+      enableIpConnect: true
+      enableKerberos: true
+      enableShareableLink: true
+      name: 'bas-aipbmax'
+      networkSecurityGroupResourceId: '<networkSecurityGroupResourceId>'
+      scaleUnits: 3
+      sku: 'Standard'
+      subnetAddressPrefix: '10.1.1.0/26'
+    }
+    containerRegistryConfiguration: {
       name: 'craipbmax'
       trustPolicyStatus: 'disabled'
     }
-    keyVaultSettings: {
+    keyVaultConfiguration: {
       enablePurgeProtection: false
       name: '<name>'
     }
-    logAnalyticsSettings: {
+    logAnalyticsConfiguration: {
       name: 'log-aipbmax'
     }
-    managedIdentitySettings: {
-      name: 'id-aipbmax'
+    managedIdentityConfiguration: {
+      hubName: 'id-hub-aipbmax'
+      projectName: 'id-project-aipbmax'
     }
-    storageAccountSettings: {
+    storageAccountConfiguration: {
       allowSharedKeyAccess: true
       name: 'staipbmax'
       sku: 'Standard_GRS'
     }
-    workspaceHubSettings: {
+    virtualMachineConfiguration: {
+      adminPassword: '<adminPassword>'
+      adminUsername: 'localAdminUser'
+      enableAadLoginExtension: true
+      enableAzureMonitorAgent: true
+      enabled: true
+      encryptionAtHost: false
+      imageReference: {
+        offer: 'dsvm-win-2022'
+        publisher: 'microsoft-dsvm'
+        sku: 'winserver-2022'
+        version: 'latest'
+      }
+      maintenanceConfigurationResourceId: '<maintenanceConfigurationResourceId>'
+      name: '<name>'
+      nicConfigurationConfiguration: {
+        ipConfigName: 'ipcfg-aipbmax'
+        name: 'nic-aipbmax'
+        networkSecurityGroupResourceId: '<networkSecurityGroupResourceId>'
+        privateIPAllocationMethod: 'Dynamic'
+      }
+      osDisk: {
+        caching: 'ReadOnly'
+        createOption: 'FromImage'
+        deleteOption: 'Delete'
+        diskSizeGB: 256
+        managedDisk: {
+          storageAccountType: 'Standard_LRS'
+        }
+        name: 'disk-aipbmax'
+      }
+      patchMode: 'AutomaticByPlatform'
+      size: 'Standard_DS1_v2'
+      zone: 0
+    }
+    virtualNetworkConfiguration: {
+      addressPrefix: '10.1.0.0/16'
+      enabled: true
+      name: 'vnet-aipbmax'
+      subnet: {
+        addressPrefix: '10.1.0.0/24'
+        name: 'snet-aipbmax'
+        networkSecurityGroupResourceId: '<networkSecurityGroupResourceId>'
+      }
+    }
+    workspaceConfiguration: {
       computes: [
         {
           computeType: 'ComputeInstance'
@@ -161,6 +261,7 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
           type: 'FQDN'
         }
       }
+      projectName: 'project-aipbmax'
     }
   }
 }
@@ -183,41 +284,106 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
       "value": "aipbmax"
     },
     // Non-required parameters
-    "applicationInsightsSettings": {
+    "applicationInsightsConfiguration": {
       "value": {
         "name": "appi-aipbmax"
       }
     },
-    "containerRegistrySettings": {
+    "bastionConfiguration": {
+      "value": {
+        "disableCopyPaste": true,
+        "enabled": true,
+        "enableFileCopy": true,
+        "enableIpConnect": true,
+        "enableKerberos": true,
+        "enableShareableLink": true,
+        "name": "bas-aipbmax",
+        "networkSecurityGroupResourceId": "<networkSecurityGroupResourceId>",
+        "scaleUnits": 3,
+        "sku": "Standard",
+        "subnetAddressPrefix": "10.1.1.0/26"
+      }
+    },
+    "containerRegistryConfiguration": {
       "value": {
         "name": "craipbmax",
         "trustPolicyStatus": "disabled"
       }
     },
-    "keyVaultSettings": {
+    "keyVaultConfiguration": {
       "value": {
         "enablePurgeProtection": false,
         "name": "<name>"
       }
     },
-    "logAnalyticsSettings": {
+    "logAnalyticsConfiguration": {
       "value": {
         "name": "log-aipbmax"
       }
     },
-    "managedIdentitySettings": {
+    "managedIdentityConfiguration": {
       "value": {
-        "name": "id-aipbmax"
+        "hubName": "id-hub-aipbmax",
+        "projectName": "id-project-aipbmax"
       }
     },
-    "storageAccountSettings": {
+    "storageAccountConfiguration": {
       "value": {
         "allowSharedKeyAccess": true,
         "name": "staipbmax",
         "sku": "Standard_GRS"
       }
     },
-    "workspaceHubSettings": {
+    "virtualMachineConfiguration": {
+      "value": {
+        "adminPassword": "<adminPassword>",
+        "adminUsername": "localAdminUser",
+        "enableAadLoginExtension": true,
+        "enableAzureMonitorAgent": true,
+        "enabled": true,
+        "encryptionAtHost": false,
+        "imageReference": {
+          "offer": "dsvm-win-2022",
+          "publisher": "microsoft-dsvm",
+          "sku": "winserver-2022",
+          "version": "latest"
+        },
+        "maintenanceConfigurationResourceId": "<maintenanceConfigurationResourceId>",
+        "name": "<name>",
+        "nicConfigurationConfiguration": {
+          "ipConfigName": "ipcfg-aipbmax",
+          "name": "nic-aipbmax",
+          "networkSecurityGroupResourceId": "<networkSecurityGroupResourceId>",
+          "privateIPAllocationMethod": "Dynamic"
+        },
+        "osDisk": {
+          "caching": "ReadOnly",
+          "createOption": "FromImage",
+          "deleteOption": "Delete",
+          "diskSizeGB": 256,
+          "managedDisk": {
+            "storageAccountType": "Standard_LRS"
+          },
+          "name": "disk-aipbmax"
+        },
+        "patchMode": "AutomaticByPlatform",
+        "size": "Standard_DS1_v2",
+        "zone": 0
+      }
+    },
+    "virtualNetworkConfiguration": {
+      "value": {
+        "addressPrefix": "10.1.0.0/16",
+        "enabled": true,
+        "name": "vnet-aipbmax",
+        "subnet": {
+          "addressPrefix": "10.1.0.0/24",
+          "name": "snet-aipbmax",
+          "networkSecurityGroupResourceId": "<networkSecurityGroupResourceId>"
+        }
+      }
+    },
+    "workspaceConfiguration": {
       "value": {
         "computes": [
           {
@@ -239,7 +405,8 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
             "destination": "pypi.org",
             "type": "FQDN"
           }
-        }
+        },
+        "projectName": "project-aipbmax"
       }
     }
   }
@@ -249,7 +416,119 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
 </details>
 <p>
 
-### Example 3: _WAF-aligned_
+### Example 3: _Without virtual machine_
+
+This instance deploys the module with a virtual network, but no virtual machine or Azure Bastion host.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
+  name: 'baselineDeployment'
+  params: {
+    // Required parameters
+    name: '<name>'
+    // Non-required parameters
+    bastionConfiguration: {
+      enabled: false
+    }
+    virtualMachineConfiguration: {
+      enabled: false
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "name": {
+      "value": "<name>"
+    },
+    // Non-required parameters
+    "bastionConfiguration": {
+      "value": {
+        "enabled": false
+      }
+    },
+    "virtualMachineConfiguration": {
+      "value": {
+        "enabled": false
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 4: _Without virtual network_
+
+This instance deploys the module without a virtual network, virtual machine or Azure Bastion host.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
+  name: 'baselineDeployment'
+  params: {
+    // Required parameters
+    name: '<name>'
+    // Non-required parameters
+    virtualNetworkConfiguration: {
+      enabled: false
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "name": {
+      "value": "<name>"
+    },
+    // Non-required parameters
+    "virtualNetworkConfiguration": {
+      "value": {
+        "enabled": false
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 5: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
@@ -269,7 +548,16 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
       Env: 'test'
       'hidden-title': 'This is visible in the resource name'
     }
-    workspaceHubSettings: {
+    virtualMachineConfiguration: {
+      adminPassword: '<adminPassword>'
+      adminUsername: 'localAdminUser'
+      enableAadLoginExtension: true
+      enableAzureMonitorAgent: true
+      maintenanceConfigurationResourceId: '<maintenanceConfigurationResourceId>'
+      patchMode: 'AutomaticByPlatform'
+      zone: 1
+    }
+    workspaceConfiguration: {
       networkIsolationMode: 'AllowOnlyApprovedOutbound'
       networkOutboundRules: {
         rule: {
@@ -309,7 +597,18 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
         "hidden-title": "This is visible in the resource name"
       }
     },
-    "workspaceHubSettings": {
+    "virtualMachineConfiguration": {
+      "value": {
+        "adminPassword": "<adminPassword>",
+        "adminUsername": "localAdminUser",
+        "enableAadLoginExtension": true,
+        "enableAzureMonitorAgent": true,
+        "maintenanceConfigurationResourceId": "<maintenanceConfigurationResourceId>",
+        "patchMode": "AutomaticByPlatform",
+        "zone": 1
+      }
+    },
+    "workspaceConfiguration": {
       "value": {
         "networkIsolationMode": "AllowOnlyApprovedOutbound",
         "networkOutboundRules": {
@@ -343,16 +642,19 @@ module baseline 'br/public:avm/ptn/ai-platform/baseline:<version>' = {
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`applicationInsightsSettings`](#parameter-applicationinsightssettings) | object | Settings for Application Insights. |
-| [`containerRegistrySettings`](#parameter-containerregistrysettings) | object | Settings for the container registry. |
+| [`applicationInsightsConfiguration`](#parameter-applicationinsightsconfiguration) | object | Configuration for Application Insights. |
+| [`bastionConfiguration`](#parameter-bastionconfiguration) | object | Configuration for the Azure Bastion host. |
+| [`containerRegistryConfiguration`](#parameter-containerregistryconfiguration) | object | Configuration for the container registry. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
-| [`keyVaultSettings`](#parameter-keyvaultsettings) | object | Settings for the key vault. |
+| [`keyVaultConfiguration`](#parameter-keyvaultconfiguration) | object | Configuration for the key vault. |
 | [`location`](#parameter-location) | string | Location for all Resources. |
-| [`logAnalyticsSettings`](#parameter-loganalyticssettings) | object | Settings for the Log Analytics workspace. |
-| [`managedIdentitySettings`](#parameter-managedidentitysettings) | object | Settings for the user-assigned managed identity. |
-| [`storageAccountSettings`](#parameter-storageaccountsettings) | object | Settings for the storage account. |
+| [`logAnalyticsConfiguration`](#parameter-loganalyticsconfiguration) | object | Configuration for the Log Analytics workspace. |
+| [`managedIdentityConfiguration`](#parameter-managedidentityconfiguration) | object | Configuration for the user-assigned managed identities. |
+| [`storageAccountConfiguration`](#parameter-storageaccountconfiguration) | object | Configuration for the storage account. |
 | [`tags`](#parameter-tags) | object | Resource tags. |
-| [`workspaceHubSettings`](#parameter-workspacehubsettings) | object | Settings for the AI Studio workspace hub. |
+| [`virtualMachineConfiguration`](#parameter-virtualmachineconfiguration) | secureObject | Configuration for the virtual machine. |
+| [`virtualNetworkConfiguration`](#parameter-virtualnetworkconfiguration) | object | Configuration for the virtual network. |
+| [`workspaceConfiguration`](#parameter-workspaceconfiguration) | object | Configuration for the AI Studio workspace. |
 
 ### Parameter: `name`
 
@@ -361,9 +663,9 @@ Alphanumberic suffix to use for resource naming.
 - Required: Yes
 - Type: string
 
-### Parameter: `applicationInsightsSettings`
+### Parameter: `applicationInsightsConfiguration`
 
-Settings for Application Insights.
+Configuration for Application Insights.
 
 - Required: No
 - Type: object
@@ -372,18 +674,18 @@ Settings for Application Insights.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`name`](#parameter-applicationinsightssettingsname) | string | The name of the Application Insights resource. |
+| [`name`](#parameter-applicationinsightsconfigurationname) | string | The name of the Application Insights resource. |
 
-### Parameter: `applicationInsightsSettings.name`
+### Parameter: `applicationInsightsConfiguration.name`
 
 The name of the Application Insights resource.
 
 - Required: No
 - Type: string
 
-### Parameter: `containerRegistrySettings`
+### Parameter: `bastionConfiguration`
 
-Settings for the container registry.
+Configuration for the Azure Bastion host.
 
 - Required: No
 - Type: object
@@ -392,17 +694,124 @@ Settings for the container registry.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`name`](#parameter-containerregistrysettingsname) | string | The name of the container registry. |
-| [`trustPolicyStatus`](#parameter-containerregistrysettingstrustpolicystatus) | string | Whether the trust policy is enabled for the container registry. Defaults to 'enabled'. |
+| [`disableCopyPaste`](#parameter-bastionconfigurationdisablecopypaste) | bool | Choose to disable or enable Copy Paste. |
+| [`enabled`](#parameter-bastionconfigurationenabled) | bool | Whether to create a Bastion host in the virtual network. Defaults to 'true'. |
+| [`enableFileCopy`](#parameter-bastionconfigurationenablefilecopy) | bool | Choose to disable or enable File Copy. |
+| [`enableIpConnect`](#parameter-bastionconfigurationenableipconnect) | bool | Choose to disable or enable IP Connect. |
+| [`enableKerberos`](#parameter-bastionconfigurationenablekerberos) | bool | Choose to disable or enable Kerberos authentication. |
+| [`enableShareableLink`](#parameter-bastionconfigurationenableshareablelink) | bool | Choose to disable or enable Shareable Link. |
+| [`name`](#parameter-bastionconfigurationname) | string | The name of the Bastion host to create. |
+| [`networkSecurityGroupResourceId`](#parameter-bastionconfigurationnetworksecuritygroupresourceid) | string | The resource ID of an existing network security group to associate with the Azure Bastion subnet. |
+| [`scaleUnits`](#parameter-bastionconfigurationscaleunits) | int | The scale units for the Bastion Host resource. |
+| [`sku`](#parameter-bastionconfigurationsku) | string | The SKU of the Bastion host to create. |
+| [`subnetAddressPrefix`](#parameter-bastionconfigurationsubnetaddressprefix) | string | The address prefix of the Azure Bastion subnet. |
+
+### Parameter: `bastionConfiguration.disableCopyPaste`
+
+Choose to disable or enable Copy Paste.
+
+- Required: No
+- Type: bool
+
+### Parameter: `bastionConfiguration.enabled`
+
+Whether to create a Bastion host in the virtual network. Defaults to 'true'.
+
+- Required: No
+- Type: bool
+
+### Parameter: `bastionConfiguration.enableFileCopy`
+
+Choose to disable or enable File Copy.
+
+- Required: No
+- Type: bool
+
+### Parameter: `bastionConfiguration.enableIpConnect`
+
+Choose to disable or enable IP Connect.
+
+- Required: No
+- Type: bool
+
+### Parameter: `bastionConfiguration.enableKerberos`
+
+Choose to disable or enable Kerberos authentication.
+
+- Required: No
+- Type: bool
+
+### Parameter: `bastionConfiguration.enableShareableLink`
+
+Choose to disable or enable Shareable Link.
+
+- Required: No
+- Type: bool
+
+### Parameter: `bastionConfiguration.name`
+
+The name of the Bastion host to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `bastionConfiguration.networkSecurityGroupResourceId`
+
+The resource ID of an existing network security group to associate with the Azure Bastion subnet.
+
+- Required: No
+- Type: string
+
+### Parameter: `bastionConfiguration.scaleUnits`
+
+The scale units for the Bastion Host resource.
+
+- Required: No
+- Type: int
+
+### Parameter: `bastionConfiguration.sku`
+
+The SKU of the Bastion host to create.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Basic'
+    'Standard'
+  ]
+  ```
+
+### Parameter: `bastionConfiguration.subnetAddressPrefix`
+
+The address prefix of the Azure Bastion subnet.
+
+- Required: No
+- Type: string
+
+### Parameter: `containerRegistryConfiguration`
+
+Configuration for the container registry.
 
-### Parameter: `containerRegistrySettings.name`
+- Required: No
+- Type: object
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-containerregistryconfigurationname) | string | The name of the container registry. |
+| [`trustPolicyStatus`](#parameter-containerregistryconfigurationtrustpolicystatus) | string | Whether the trust policy is enabled for the container registry. Defaults to 'enabled'. |
+
+### Parameter: `containerRegistryConfiguration.name`
 
 The name of the container registry.
 
 - Required: No
 - Type: string
 
-### Parameter: `containerRegistrySettings.trustPolicyStatus`
+### Parameter: `containerRegistryConfiguration.trustPolicyStatus`
 
 Whether the trust policy is enabled for the container registry. Defaults to 'enabled'.
 
@@ -424,9 +833,9 @@ Enable/Disable usage telemetry for module.
 - Type: bool
 - Default: `True`
 
-### Parameter: `keyVaultSettings`
+### Parameter: `keyVaultConfiguration`
 
-Settings for the key vault.
+Configuration for the key vault.
 
 - Required: No
 - Type: object
@@ -435,17 +844,17 @@ Settings for the key vault.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`enablePurgeProtection`](#parameter-keyvaultsettingsenablepurgeprotection) | bool | Provide 'true' to enable Key Vault's purge protection feature. Defaults to 'true'. |
-| [`name`](#parameter-keyvaultsettingsname) | string | The name of the key vault. |
+| [`enablePurgeProtection`](#parameter-keyvaultconfigurationenablepurgeprotection) | bool | Provide 'true' to enable Key Vault's purge protection feature. Defaults to 'true'. |
+| [`name`](#parameter-keyvaultconfigurationname) | string | The name of the key vault. |
 
-### Parameter: `keyVaultSettings.enablePurgeProtection`
+### Parameter: `keyVaultConfiguration.enablePurgeProtection`
 
 Provide 'true' to enable Key Vault's purge protection feature. Defaults to 'true'.
 
 - Required: No
 - Type: bool
 
-### Parameter: `keyVaultSettings.name`
+### Parameter: `keyVaultConfiguration.name`
 
 The name of the key vault.
 
@@ -460,9 +869,9 @@ Location for all Resources.
 - Type: string
 - Default: `[resourceGroup().location]`
 
-### Parameter: `logAnalyticsSettings`
+### Parameter: `logAnalyticsConfiguration`
 
-Settings for the Log Analytics workspace.
+Configuration for the Log Analytics workspace.
 
 - Required: No
 - Type: object
@@ -471,18 +880,18 @@ Settings for the Log Analytics workspace.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`name`](#parameter-loganalyticssettingsname) | string | The name of the Log Analytics workspace. |
+| [`name`](#parameter-loganalyticsconfigurationname) | string | The name of the Log Analytics workspace. |
 
-### Parameter: `logAnalyticsSettings.name`
+### Parameter: `logAnalyticsConfiguration.name`
 
 The name of the Log Analytics workspace.
 
 - Required: No
 - Type: string
 
-### Parameter: `managedIdentitySettings`
+### Parameter: `managedIdentityConfiguration`
 
-Settings for the user-assigned managed identity.
+Configuration for the user-assigned managed identities.
 
 - Required: No
 - Type: object
@@ -491,18 +900,26 @@ Settings for the user-assigned managed identity.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`name`](#parameter-managedidentitysettingsname) | string | The name of the user-assigned managed identity. |
+| [`hubName`](#parameter-managedidentityconfigurationhubname) | string | The name of the workspace hub user-assigned managed identity. |
+| [`projectName`](#parameter-managedidentityconfigurationprojectname) | string | The name of the workspace project user-assigned managed identity. |
+
+### Parameter: `managedIdentityConfiguration.hubName`
+
+The name of the workspace hub user-assigned managed identity.
+
+- Required: No
+- Type: string
 
-### Parameter: `managedIdentitySettings.name`
+### Parameter: `managedIdentityConfiguration.projectName`
 
-The name of the user-assigned managed identity.
+The name of the workspace project user-assigned managed identity.
 
 - Required: No
 - Type: string
 
-### Parameter: `storageAccountSettings`
+### Parameter: `storageAccountConfiguration`
 
-Settings for the storage account.
+Configuration for the storage account.
 
 - Required: No
 - Type: object
@@ -511,25 +928,25 @@ Settings for the storage account.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`allowSharedKeyAccess`](#parameter-storageaccountsettingsallowsharedkeyaccess) | bool | Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Microsoft Entra ID. Defaults to 'false'. |
-| [`name`](#parameter-storageaccountsettingsname) | string | The name of the storage account. |
-| [`sku`](#parameter-storageaccountsettingssku) | string | Storage account SKU. Defaults to 'Standard_RAGZRS'. |
+| [`allowSharedKeyAccess`](#parameter-storageaccountconfigurationallowsharedkeyaccess) | bool | Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Microsoft Entra ID. Defaults to 'false'. |
+| [`name`](#parameter-storageaccountconfigurationname) | string | The name of the storage account. |
+| [`sku`](#parameter-storageaccountconfigurationsku) | string | Storage account SKU. Defaults to 'Standard_RAGZRS'. |
 
-### Parameter: `storageAccountSettings.allowSharedKeyAccess`
+### Parameter: `storageAccountConfiguration.allowSharedKeyAccess`
 
 Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Microsoft Entra ID. Defaults to 'false'.
 
 - Required: No
 - Type: bool
 
-### Parameter: `storageAccountSettings.name`
+### Parameter: `storageAccountConfiguration.name`
 
 The name of the storage account.
 
 - Required: No
 - Type: string
 
-### Parameter: `storageAccountSettings.sku`
+### Parameter: `storageAccountConfiguration.sku`
 
 Storage account SKU. Defaults to 'Standard_RAGZRS'.
 
@@ -556,9 +973,89 @@ Resource tags.
 - Required: No
 - Type: object
 
-### Parameter: `workspaceHubSettings`
+### Parameter: `virtualMachineConfiguration`
+
+Configuration for the virtual machine.
+
+- Required: No
+- Type: secureObject
+
+### Parameter: `virtualNetworkConfiguration`
+
+Configuration for the virtual network.
+
+- Required: No
+- Type: object
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`addressPrefix`](#parameter-virtualnetworkconfigurationaddressprefix) | string | The address prefix of the virtual network to create. |
+| [`enabled`](#parameter-virtualnetworkconfigurationenabled) | bool | Whether to create an associated virtual network. Defaults to 'true'. |
+| [`name`](#parameter-virtualnetworkconfigurationname) | string | The name of the virtual network to create. |
+| [`subnet`](#parameter-virtualnetworkconfigurationsubnet) | object | Configuration for the virual network subnet. |
+
+### Parameter: `virtualNetworkConfiguration.addressPrefix`
+
+The address prefix of the virtual network to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `virtualNetworkConfiguration.enabled`
+
+Whether to create an associated virtual network. Defaults to 'true'.
+
+- Required: No
+- Type: bool
+
+### Parameter: `virtualNetworkConfiguration.name`
+
+The name of the virtual network to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `virtualNetworkConfiguration.subnet`
+
+Configuration for the virual network subnet.
+
+- Required: No
+- Type: object
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`addressPrefix`](#parameter-virtualnetworkconfigurationsubnetaddressprefix) | string | The address prefix of the subnet to create. |
+| [`name`](#parameter-virtualnetworkconfigurationsubnetname) | string | The name of the subnet to create. |
+| [`networkSecurityGroupResourceId`](#parameter-virtualnetworkconfigurationsubnetnetworksecuritygroupresourceid) | string | The resource ID of an existing network security group to associate with the subnet. |
+
+### Parameter: `virtualNetworkConfiguration.subnet.addressPrefix`
+
+The address prefix of the subnet to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `virtualNetworkConfiguration.subnet.name`
+
+The name of the subnet to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `virtualNetworkConfiguration.subnet.networkSecurityGroupResourceId`
+
+The resource ID of an existing network security group to associate with the subnet.
+
+- Required: No
+- Type: string
+
+### Parameter: `workspaceConfiguration`
 
-Settings for the AI Studio workspace hub.
+Configuration for the AI Studio workspace.
 
 - Required: No
 - Type: object
@@ -567,26 +1064,27 @@ Settings for the AI Studio workspace hub.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`computes`](#parameter-workspacehubsettingscomputes) | array | Computes to create and attach to the workspace hub. |
-| [`name`](#parameter-workspacehubsettingsname) | string | The name of the AI Studio workspace hub. |
-| [`networkIsolationMode`](#parameter-workspacehubsettingsnetworkisolationmode) | string | The network isolation mode of the workspace hub. Defaults to 'AllowInternetOutbound'. |
-| [`networkOutboundRules`](#parameter-workspacehubsettingsnetworkoutboundrules) | object | The outbound rules for the managed network of the workspace hub. |
+| [`computes`](#parameter-workspaceconfigurationcomputes) | array | Computes to create and attach to the workspace hub. |
+| [`name`](#parameter-workspaceconfigurationname) | string | The name of the AI Studio workspace hub. |
+| [`networkIsolationMode`](#parameter-workspaceconfigurationnetworkisolationmode) | string | The network isolation mode of the workspace hub. Defaults to 'AllowInternetOutbound'. |
+| [`networkOutboundRules`](#parameter-workspaceconfigurationnetworkoutboundrules) | object | The outbound rules for the managed network of the workspace hub. |
+| [`projectName`](#parameter-workspaceconfigurationprojectname) | string | The name of the AI Studio workspace project. |
 
-### Parameter: `workspaceHubSettings.computes`
+### Parameter: `workspaceConfiguration.computes`
 
 Computes to create and attach to the workspace hub.
 
 - Required: No
 - Type: array
 
-### Parameter: `workspaceHubSettings.name`
+### Parameter: `workspaceConfiguration.name`
 
 The name of the AI Studio workspace hub.
 
 - Required: No
 - Type: string
 
-### Parameter: `workspaceHubSettings.networkIsolationMode`
+### Parameter: `workspaceConfiguration.networkIsolationMode`
 
 The network isolation mode of the workspace hub. Defaults to 'AllowInternetOutbound'.
 
@@ -600,7 +1098,7 @@ The network isolation mode of the workspace hub. Defaults to 'AllowInternetOutbo
   ]
   ```
 
-### Parameter: `workspaceHubSettings.networkOutboundRules`
+### Parameter: `workspaceConfiguration.networkOutboundRules`
 
 The outbound rules for the managed network of the workspace hub.
 
@@ -611,9 +1109,9 @@ The outbound rules for the managed network of the workspace hub.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`>Any_other_property<`](#parameter-workspacehubsettingsnetworkoutboundrules>any_other_property<) | object | The outbound rule. The name of the rule is the object key. |
+| [`>Any_other_property<`](#parameter-workspaceconfigurationnetworkoutboundrules>any_other_property<) | object | The outbound rule. The name of the rule is the object key. |
 
-### Parameter: `workspaceHubSettings.networkOutboundRules.>Any_other_property<`
+### Parameter: `workspaceConfiguration.networkOutboundRules.>Any_other_property<`
 
 The outbound rule. The name of the rule is the object key.
 
@@ -629,6 +1127,8 @@ The outbound rule. The name of the rule is the object key.
 | `applicationInsightsInstrumentationKey` | string | The instrumentation key of the application insights component. |
 | `applicationInsightsName` | string | The name of the application insights component. |
 | `applicationInsightsResourceId` | string | The resource ID of the application insights component. |
+| `bastionName` | string | The name of the Azure Bastion host. |
+| `bastionResourceId` | string | The resource ID of the Azure Bastion host. |
 | `containerRegistryName` | string | The name of the container registry. |
 | `containerRegistryResourceId` | string | The resource ID of the container registry. |
 | `keyVaultName` | string | The name of the key vault. |
@@ -637,15 +1137,27 @@ The outbound rule. The name of the rule is the object key.
 | `location` | string | The location the module was deployed to. |
 | `logAnalyticsWorkspaceName` | string | The name of the log analytics workspace. |
 | `logAnalyticsWorkspaceResourceId` | string | The resource ID of the log analytics workspace. |
-| `managedIdentityClientId` | string | The client ID of the user assigned managed identity. |
-| `managedIdentityName` | string | The name of the user assigned managed identity. |
-| `managedIdentityPrincipalId` | string | The principal ID of the user assigned managed identity. |
-| `managedIdentityResourceId` | string | The resource ID of the user assigned managed identity. |
+| `managedIdentityHubClientId` | string | The client ID of the workspace hub user assigned managed identity. |
+| `managedIdentityHubName` | string | The name of the workspace hub user assigned managed identity. |
+| `managedIdentityHubPrincipalId` | string | The principal ID of the workspace hub user assigned managed identity. |
+| `managedIdentityHubResourceId` | string | The resource ID of the workspace hub user assigned managed identity. |
+| `managedIdentityProjectClientId` | string | The client ID of the workspace project user assigned managed identity. |
+| `managedIdentityProjectName` | string | The name of the workspace project user assigned managed identity. |
+| `managedIdentityProjectPrincipalId` | string | The principal ID of the workspace project user assigned managed identity. |
+| `managedIdentityProjectResourceId` | string | The resource ID of the workspace project user assigned managed identity. |
 | `resourceGroupName` | string | The name of the resource group the module was deployed to. |
 | `storageAccountName` | string | The name of the storage account. |
 | `storageAccountResourceId` | string | The resource ID of the storage account. |
+| `virtualMachineName` | string | The name of the virtual machine. |
+| `virtualMachineResourceId` | string | The resource ID of the virtual machine. |
+| `virtualNetworkName` | string | The name of the virtual network. |
+| `virtualNetworkResourceId` | string | The resource ID of the virtual network. |
+| `virtualNetworkSubnetName` | string | The name of the subnet in the virtual network. |
+| `virtualNetworkSubnetResourceId` | string | The resource ID of the subnet in the virtual network. |
 | `workspaceHubName` | string | The name of the workspace hub. |
 | `workspaceHubResourceId` | string | The resource ID of the workspace hub. |
+| `workspaceProjectName` | string | The name of the workspace project. |
+| `workspaceProjectResourceId` | string | The resource ID of the workspace project. |
 
 ## Cross-referenced modules
 
@@ -653,10 +1165,14 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
+| `br/public:avm/res/compute/virtual-machine:0.5.3` | Remote reference |
 | `br/public:avm/res/container-registry/registry:0.3.1` | Remote reference |
 | `br/public:avm/res/insights/component:0.3.1` | Remote reference |
 | `br/public:avm/res/key-vault/vault:0.6.2` | Remote reference |
-| `br/public:avm/res/machine-learning-services/workspace:0.4.0` | Remote reference |
+| `br/public:avm/res/machine-learning-services/workspace:0.5.0` | Remote reference |
+| `br/public:avm/res/network/bastion-host:0.2.2` | Remote reference |
+| `br/public:avm/res/network/network-security-group:0.3.1` | Remote reference |
+| `br/public:avm/res/network/private-dns-zone:0.3.1` | Remote reference |
 | `br/public:avm/res/storage/storage-account:0.11.0` | Remote reference |
 
 ## Data Collection
diff --git a/avm/ptn/ai-platform/baseline/main.bicep b/avm/ptn/ai-platform/baseline/main.bicep
index ef04db37ed..d3095c0f79 100644
--- a/avm/ptn/ai-platform/baseline/main.bicep
+++ b/avm/ptn/ai-platform/baseline/main.bicep
@@ -17,26 +17,61 @@ param tags object?
 @description('Optional. Enable/Disable usage telemetry for module.')
 param enableTelemetry bool = true
 
-@description('Optional. Settings for the user-assigned managed identity.')
-param managedIdentitySettings managedIdentitySettingType
+@description('Optional. Configuration for the user-assigned managed identities.')
+param managedIdentityConfiguration managedIdentityConfigurationType
 
-@description('Optional. Settings for the Log Analytics workspace.')
-param logAnalyticsSettings logAnalyticsSettingType
+@description('Optional. Configuration for the Log Analytics workspace.')
+param logAnalyticsConfiguration logAnalyticsConfigurationType
 
-@description('Optional. Settings for the key vault.')
-param keyVaultSettings keyVaultSettingType
+@description('Optional. Configuration for the key vault.')
+param keyVaultConfiguration keyVaultConfigurationType
 
-@description('Optional. Settings for the storage account.')
-param storageAccountSettings storageAccountSettingType
+@description('Optional. Configuration for the storage account.')
+param storageAccountConfiguration storageAccountConfigurationType
 
-@description('Optional. Settings for the container registry.')
-param containerRegistrySettings containerRegistrySettingType
+@description('Optional. Configuration for the container registry.')
+param containerRegistryConfiguration containerRegistryConfigurationType
 
-@description('Optional. Settings for Application Insights.')
-param applicationInsightsSettings applicationInsightsSettingType
+@description('Optional. Configuration for Application Insights.')
+param applicationInsightsConfiguration applicationInsightsConfigurationType
 
-@description('Optional. Settings for the AI Studio workspace hub.')
-param workspaceHubSettings workspaceHubSettingType
+@description('Optional. Configuration for the AI Studio workspace.')
+param workspaceConfiguration workspaceConfigurationType
+
+@description('Optional. Configuration for the virtual network.')
+param virtualNetworkConfiguration virtualNetworkConfigurationType
+
+@description('Optional. Configuration for the Azure Bastion host.')
+param bastionConfiguration bastionConfigurationType
+
+@description('Optional. Configuration for the virtual machine.')
+param virtualMachineConfiguration virtualMachineConfigurationType
+
+// ============== //
+// Variables      //
+// ============== //
+
+var createVirtualNetwork = virtualNetworkConfiguration.?enabled != false
+
+var createBastion = createVirtualNetwork && bastionConfiguration.?enabled != false
+
+var createVirtualMachine = createVirtualNetwork && virtualMachineConfiguration.?enabled != false
+
+var createDefaultNsg = virtualNetworkConfiguration.?subnet.networkSecurityGroupResourceId == null
+
+var subnetResourceId = createVirtualNetwork ? virtualNetwork::defaultSubnet.id : null
+
+var mlTargetSubResource = 'amlworkspace'
+
+var mlPrivateDnsZones = {
+  'privatelink.api.azureml.ms': mlTargetSubResource
+  'privatelink.notebooks.azure.net': mlTargetSubResource
+}
+
+var storagePrivateDnsZones = {
+  'privatelink.blob.${environment().suffixes.storage}': 'blob'
+  'privatelink.file.${environment().suffixes.storage}': 'file'
+}
 
 // ============== //
 // Resources      //
@@ -61,22 +96,222 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableT
   }
 }
 
-resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
-  name: managedIdentitySettings.?name ?? 'id-${name}'
+module storageAccount_privateDnsZones 'br/public:avm/res/network/private-dns-zone:0.3.1' = [
+  for zone in objectKeys(storagePrivateDnsZones): if (createVirtualNetwork) {
+    name: '${uniqueString(deployment().name, location, zone)}-storage-private-dns-zones'
+    params: {
+      name: zone
+      virtualNetworkLinks: [
+        {
+          virtualNetworkResourceId: virtualNetwork.id
+        }
+      ]
+    }
+  }
+]
+
+module workspaceHub_privateDnsZones 'br/public:avm/res/network/private-dns-zone:0.3.1' = [
+  for zone in objectKeys(mlPrivateDnsZones): if (createVirtualNetwork) {
+    name: '${uniqueString(deployment().name, location, zone)}-workspace-private-dns-zones'
+    params: {
+      name: zone
+      virtualNetworkLinks: [
+        {
+          virtualNetworkResourceId: virtualNetwork.id
+        }
+      ]
+      roleAssignments: [
+        {
+          principalId: managedIdentityHub.properties.principalId
+          roleDefinitionIdOrName: 'Contributor'
+          principalType: 'ServicePrincipal'
+        }
+      ]
+    }
+  }
+]
+
+module defaultNetworkSecurityGroup 'br/public:avm/res/network/network-security-group:0.3.1' = if (createDefaultNsg) {
+  name: '${uniqueString(deployment().name, location)}-nsg'
+  params: {
+    name: 'nsg-${name}'
+    location: location
+    securityRules: [
+      {
+        name: 'DenySshRdpOutbound'
+        properties: {
+          priority: 200
+          access: 'Deny'
+          protocol: '*'
+          direction: 'Outbound'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRanges: [
+            '3389'
+            '22'
+          ]
+        }
+      }
+    ]
+    tags: tags
+  }
+}
+
+// Not using the br/public:avm/res/network/virtual-network module here to
+// allow consumers of the module to add subnets from outside of the module
+// https://github.com/Azure/bicep-registry-modules/issues/2689
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-01-01' = if (createVirtualNetwork) {
+  name: virtualNetworkConfiguration.?name ?? 'vnet-${name}'
+  location: location
+  tags: tags
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        virtualNetworkConfiguration.?addressPrefix ?? '10.0.0.0/16'
+      ]
+    }
+  }
+
+  resource defaultSubnet 'subnets@2024-01-01' = {
+    name: virtualNetworkConfiguration.?subnet.name ?? 'default'
+    properties: {
+      addressPrefix: virtualNetworkConfiguration.?subnet.addressPrefix ?? '10.0.0.0/24'
+      networkSecurityGroup: {
+        id: createDefaultNsg
+          ? defaultNetworkSecurityGroup.outputs.resourceId
+          : virtualNetworkConfiguration.?subnet.networkSecurityGroupResourceId
+      }
+    }
+  }
+
+  resource bastionSubnet 'subnets@2024-01-01' = if (createBastion) {
+    name: 'AzureBastionSubnet'
+    properties: {
+      addressPrefix: bastionConfiguration.?subnetAddressPrefix ?? '10.0.1.0/26'
+      networkSecurityGroup: bastionConfiguration.?networkSecurityGroupResourceId != null
+        ? {
+            id: bastionConfiguration.?networkSecurityGroupResourceId
+          }
+        : null
+    }
+
+    dependsOn: [
+      defaultSubnet
+    ]
+  }
+}
+
+module bastion 'br/public:avm/res/network/bastion-host:0.2.2' = if (createBastion) {
+  name: '${uniqueString(deployment().name, location)}-bastion-host'
+  params: {
+    name: bastionConfiguration.?name ?? 'bas-${name}'
+    location: location
+    skuName: bastionConfiguration.?sku ?? 'Standard'
+    enableTelemetry: enableTelemetry
+    virtualNetworkResourceId: virtualNetwork.id
+    disableCopyPaste: bastionConfiguration.?disableCopyPaste
+    enableFileCopy: bastionConfiguration.?enableFileCopy
+    enableIpConnect: bastionConfiguration.?enableIpConnect
+    enableKerberos: bastionConfiguration.?enableKerberos
+    enableShareableLink: bastionConfiguration.?enableShareableLink
+    scaleUnits: bastionConfiguration.?scaleUnits
+    tags: tags
+  }
+}
+
+module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.5.3' = if (createVirtualMachine) {
+  name: '${uniqueString(deployment().name, location)}-virtual-machine'
+  params: {
+    name: virtualMachineConfiguration.?name ?? 'vm-${name}'
+    computerName: virtualMachineConfiguration.?name ?? take('vm-${name}', 15)
+    location: location
+    enableTelemetry: enableTelemetry
+    adminUsername: virtualMachineConfiguration.?adminUsername ?? ''
+    adminPassword: virtualMachineConfiguration.?adminPassword
+    nicConfigurations: [
+      {
+        name: virtualMachineConfiguration.?nicConfigurationConfiguration.name ?? 'nic-vm-${name}'
+        location: location
+        networkSecurityGroupResourceId: virtualMachineConfiguration.?nicConfigurationConfiguration.networkSecurityGroupResourceId
+        ipConfigurations: [
+          {
+            name: virtualMachineConfiguration.?nicConfigurationConfiguration.ipConfigName ?? 'nic-vm-${name}-ipconfig'
+            privateIPAllocationMethod: virtualMachineConfiguration.?nicConfigurationConfiguration.privateIPAllocationMethod ?? 'Dynamic'
+            subnetResourceId: virtualNetwork::defaultSubnet.id
+          }
+        ]
+      }
+    ]
+    imageReference: virtualMachineConfiguration.?imageReference ?? {
+      publisher: 'microsoft-dsvm'
+      offer: 'dsvm-win-2022'
+      sku: 'winserver-2022'
+      version: 'latest'
+    }
+    osDisk: virtualMachineConfiguration.?osDisk ?? {
+      createOption: 'FromImage'
+      managedDisk: {
+        storageAccountType: 'Premium_ZRS'
+      }
+      diskSizeGB: 128
+      caching: 'ReadWrite'
+    }
+    patchMode: virtualMachineConfiguration.?patchMode
+    osType: 'Windows'
+    encryptionAtHost: virtualMachineConfiguration.?encryptionAtHost ?? true
+    vmSize: virtualMachineConfiguration.?size ?? 'Standard_D2s_v3'
+    zone: virtualMachineConfiguration.?zone ?? 0
+    extensionAadJoinConfig: virtualMachineConfiguration.?enableAadLoginExtension == true
+      ? {
+          enabled: true
+          typeHandlerVersion: '1.0'
+        }
+      : null
+    extensionMonitoringAgentConfig: virtualMachineConfiguration.?enableAzureMonitorAgent == true
+      ? {
+          enabled: true
+        }
+      : null
+    maintenanceConfigurationResourceId: virtualMachineConfiguration.?maintenanceConfigurationResourceId
+    tags: tags
+  }
+}
+
+resource managedIdentityHub 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: managedIdentityConfiguration.?hubName ?? 'id-hub-${name}'
+  location: location
+  tags: tags
+}
+
+resource managedIdentityProject 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: managedIdentityConfiguration.?projectName ?? 'id-project-${name}'
   location: location
   tags: tags
 }
 
 resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
-  name: logAnalyticsSettings.?name ?? 'log-${name}'
+  name: logAnalyticsConfiguration.?name ?? 'log-${name}'
   location: location
   tags: tags
 }
 
+resource resourceGroup_roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(resourceGroup().id, name)
+  properties: {
+    roleDefinitionId: subscriptionResourceId(
+      'Microsoft.Authorization/roleDefinitions',
+      'acdd72a7-3385-48ef-bd42-f606fba81ae7' // Reader
+    )
+    principalId: managedIdentityHub.properties.principalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
 module keyVault 'br/public:avm/res/key-vault/vault:0.6.2' = {
   name: '${uniqueString(deployment().name, location)}-key-vault'
   params: {
-    name: keyVaultSettings.?name ?? 'kv-${name}'
+    name: keyVaultConfiguration.?name ?? 'kv-${name}'
     location: location
     enableTelemetry: enableTelemetry
     enableRbacAuthorization: true
@@ -88,15 +323,27 @@ module keyVault 'br/public:avm/res/key-vault/vault:0.6.2' = {
       bypass: 'AzureServices'
     }
     publicNetworkAccess: 'Disabled'
-    enablePurgeProtection: keyVaultSettings.?enablePurgeProtection ?? true
+    enablePurgeProtection: keyVaultConfiguration.?enablePurgeProtection ?? true
     roleAssignments: [
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityHub.properties.principalId
         roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityHub.properties.principalId
+        roleDefinitionIdOrName: 'Key Vault Administrator'
+        principalType: 'ServicePrincipal'
       }
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityProject.properties.principalId
         roleDefinitionIdOrName: 'Key Vault Administrator'
+        principalType: 'ServicePrincipal'
       }
     ]
     diagnosticSettings: [
@@ -117,55 +364,106 @@ module keyVault 'br/public:avm/res/key-vault/vault:0.6.2' = {
 module storageAccount 'br/public:avm/res/storage/storage-account:0.11.0' = {
   name: '${uniqueString(deployment().name, location)}-storage'
   params: {
-    name: storageAccountSettings.?name ?? 'st${name}'
+    name: storageAccountConfiguration.?name ?? 'st${name}'
     location: location
-    skuName: storageAccountSettings.?sku ?? 'Standard_RAGZRS'
+    skuName: storageAccountConfiguration.?sku ?? 'Standard_RAGZRS'
     enableTelemetry: enableTelemetry
     allowBlobPublicAccess: false
-    allowSharedKeyAccess: storageAccountSettings.?allowSharedKeyAccess ?? false
-    defaultToOAuthAuthentication: !(storageAccountSettings.?allowSharedKeyAccess ?? false)
+    allowSharedKeyAccess: storageAccountConfiguration.?allowSharedKeyAccess ?? true
+    defaultToOAuthAuthentication: !(storageAccountConfiguration.?allowSharedKeyAccess ?? true)
     publicNetworkAccess: 'Disabled'
     networkAcls: {
       defaultAction: 'Deny'
       bypass: 'AzureServices'
     }
+    privateEndpoints: subnetResourceId != null
+      ? map(items(storagePrivateDnsZones), zone => {
+          name: 'pep-${zone.value}-${name}'
+          customNetworkInterfaceName: 'nic-${zone.value}-${name}'
+          service: zone.value
+          subnetResourceId: subnetResourceId ?? ''
+          privateDnsZoneResourceIds: [resourceId('Microsoft.Network/privateDnsZones', zone.key)]
+        })
+      : null
     roleAssignments: [
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityHub.properties.principalId
         roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
       }
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Reader'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Storage Account Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Storage Table Data Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityHub.properties.principalId
         roleDefinitionIdOrName: 'Storage Blob Data Contributor'
+        principalType: 'ServicePrincipal'
       }
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Storage Blob Data Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityHub.properties.principalId
+        roleDefinitionIdOrName: '69566ab7-960f-475b-8e7c-b3118f30c6bd' // Storage File Data Privileged Contributor
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
         roleDefinitionIdOrName: '69566ab7-960f-475b-8e7c-b3118f30c6bd' // Storage File Data Privileged Contributor
+        principalType: 'ServicePrincipal'
       }
     ]
     tags: tags
   }
+
+  dependsOn: storageAccount_privateDnsZones
 }
 
 module containerRegistry 'br/public:avm/res/container-registry/registry:0.3.1' = {
   name: '${uniqueString(deployment().name, location)}-container-registry'
   params: {
-    name: containerRegistrySettings.?name ?? 'cr${name}'
+    name: containerRegistryConfiguration.?name ?? 'cr${name}'
     acrSku: 'Premium'
     location: location
     enableTelemetry: enableTelemetry
     publicNetworkAccess: 'Disabled'
     networkRuleBypassOptions: 'AzureServices'
     zoneRedundancy: 'Enabled'
-    trustPolicyStatus: containerRegistrySettings.?trustPolicyStatus ?? 'enabled'
+    trustPolicyStatus: containerRegistryConfiguration.?trustPolicyStatus ?? 'enabled'
     roleAssignments: [
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityHub.properties.principalId
         roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
       }
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityHub.properties.principalId
         roleDefinitionIdOrName: 'AcrPull'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'AcrPull'
+        principalType: 'ServicePrincipal'
       }
     ]
     tags: tags
@@ -175,25 +473,31 @@ module containerRegistry 'br/public:avm/res/container-registry/registry:0.3.1' =
 module applicationInsights 'br/public:avm/res/insights/component:0.3.1' = {
   name: '${uniqueString(deployment().name, location)}-appi'
   params: {
-    name: applicationInsightsSettings.?name ?? 'appi-${name}'
+    name: applicationInsightsConfiguration.?name ?? 'appi-${name}'
     location: location
     kind: 'web'
     enableTelemetry: enableTelemetry
     workspaceResourceId: logAnalyticsWorkspace.id
     roleAssignments: [
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityHub.properties.principalId
+        roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
         roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
       }
     ]
     tags: tags
   }
 }
 
-module workspaceHub 'br/public:avm/res/machine-learning-services/workspace:0.4.0' = {
+module workspaceHub 'br/public:avm/res/machine-learning-services/workspace:0.5.0' = {
   name: '${uniqueString(deployment().name, location)}-hub'
   params: {
-    name: workspaceHubSettings.?name ?? 'hub-${name}'
+    name: workspaceConfiguration.?name ?? 'hub-${name}'
     sku: 'Standard'
     location: location
     enableTelemetry: enableTelemetry
@@ -207,20 +511,70 @@ module workspaceHub 'br/public:avm/res/machine-learning-services/workspace:0.4.0
     }
     managedIdentities: {
       userAssignedResourceIds: [
-        managedIdentity.id
+        managedIdentityHub.id
       ]
     }
-    primaryUserAssignedIdentity: managedIdentity.id
-    computes: workspaceHubSettings.?computes
+    primaryUserAssignedIdentity: managedIdentityHub.id
+    computes: workspaceConfiguration.?computes
     managedNetworkSettings: {
-      isolationMode: workspaceHubSettings.?networkIsolationMode ?? 'AllowInternetOutbound'
-      outboundRules: workspaceHubSettings.?networkOutboundRules
+      isolationMode: workspaceConfiguration.?networkIsolationMode ?? 'AllowInternetOutbound'
+      outboundRules: workspaceConfiguration.?networkOutboundRules
     }
+    privateEndpoints: subnetResourceId != null
+      ? [
+          {
+            name: 'pep-${mlTargetSubResource}-${name}'
+            customNetworkInterfaceName: 'nic-${mlTargetSubResource}-${name}'
+            service: mlTargetSubResource
+            subnetResourceId: subnetResourceId ?? ''
+            privateDnsZoneGroup: {
+              privateDnsZoneGroupConfigs: map(objectKeys(mlPrivateDnsZones), zone => {
+                name: replace(zone, '.', '-')
+                privateDnsZoneResourceId: resourceId('Microsoft.Network/privateDnsZones', zone)
+              })
+            }
+          }
+        ]
+      : null
     systemDatastoresAuthMode: 'identity'
     roleAssignments: [
       {
-        principalId: managedIdentity.properties.principalId
+        principalId: managedIdentityHub.properties.principalId
         roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
+      }
+    ]
+    tags: tags
+  }
+
+  dependsOn: workspaceHub_privateDnsZones
+}
+
+module workspaceProject 'br/public:avm/res/machine-learning-services/workspace:0.5.0' = {
+  name: '${uniqueString(deployment().name, location)}-project'
+  params: {
+    name: workspaceConfiguration.?projectName ?? 'project-${name}'
+    sku: 'Standard'
+    location: location
+    enableTelemetry: enableTelemetry
+    kind: 'Project'
+    hubResourceId: workspaceHub.outputs.resourceId
+    managedIdentities: {
+      userAssignedResourceIds: [
+        managedIdentityProject.id
+      ]
+    }
+    primaryUserAssignedIdentity: managedIdentityProject.id
+    roleAssignments: [
+      {
+        principalId: managedIdentityHub.properties.principalId
+        roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
+      }
+      {
+        principalId: managedIdentityProject.properties.principalId
+        roleDefinitionIdOrName: 'Contributor'
+        principalType: 'ServicePrincipal'
       }
     ]
     tags: tags
@@ -258,17 +612,29 @@ output logAnalyticsWorkspaceResourceId string = logAnalyticsWorkspace.id
 @description('The name of the log analytics workspace.')
 output logAnalyticsWorkspaceName string = logAnalyticsWorkspace.name
 
-@description('The resource ID of the user assigned managed identity.')
-output managedIdentityResourceId string = managedIdentity.id
+@description('The resource ID of the workspace hub user assigned managed identity.')
+output managedIdentityHubResourceId string = managedIdentityHub.id
+
+@description('The name of the workspace hub user assigned managed identity.')
+output managedIdentityHubName string = managedIdentityHub.name
 
-@description('The name of the user assigned managed identity.')
-output managedIdentityName string = managedIdentity.name
+@description('The principal ID of the workspace hub user assigned managed identity.')
+output managedIdentityHubPrincipalId string = managedIdentityHub.properties.principalId
 
-@description('The principal ID of the user assigned managed identity.')
-output managedIdentityPrincipalId string = managedIdentity.properties.principalId
+@description('The client ID of the workspace hub user assigned managed identity.')
+output managedIdentityHubClientId string = managedIdentityHub.properties.clientId
 
-@description('The client ID of the user assigned managed identity.')
-output managedIdentityClientId string = managedIdentity.properties.clientId
+@description('The resource ID of the workspace project user assigned managed identity.')
+output managedIdentityProjectResourceId string = managedIdentityProject.id
+
+@description('The name of the workspace project user assigned managed identity.')
+output managedIdentityProjectName string = managedIdentityProject.name
+
+@description('The principal ID of the workspace project user assigned managed identity.')
+output managedIdentityProjectPrincipalId string = managedIdentityProject.properties.principalId
+
+@description('The client ID of the workspace project user assigned managed identity.')
+output managedIdentityProjectClientId string = managedIdentityProject.properties.clientId
 
 @description('The resource ID of the key vault.')
 output keyVaultResourceId string = keyVault.outputs.resourceId
@@ -297,21 +663,54 @@ output workspaceHubResourceId string = workspaceHub.outputs.resourceId
 @description('The name of the workspace hub.')
 output workspaceHubName string = workspaceHub.outputs.name
 
+@description('The resource ID of the workspace project.')
+output workspaceProjectResourceId string = workspaceProject.outputs.resourceId
+
+@description('The name of the workspace project.')
+output workspaceProjectName string = workspaceProject.outputs.name
+
+@description('The resource ID of the virtual network.')
+output virtualNetworkResourceId string = createVirtualNetwork ? virtualNetwork.id : ''
+
+@description('The name of the virtual network.')
+output virtualNetworkName string = createVirtualNetwork ? virtualNetwork.name : ''
+
+@description('The resource ID of the subnet in the virtual network.')
+output virtualNetworkSubnetResourceId string = createVirtualNetwork ? virtualNetwork::defaultSubnet.id : ''
+
+@description('The name of the subnet in the virtual network.')
+output virtualNetworkSubnetName string = createVirtualNetwork ? virtualNetwork::defaultSubnet.name : ''
+
+@description('The resource ID of the Azure Bastion host.')
+output bastionResourceId string = createBastion ? bastion.outputs.resourceId : ''
+
+@description('The name of the Azure Bastion host.')
+output bastionName string = createBastion ? bastion.outputs.name : ''
+
+@description('The resource ID of the virtual machine.')
+output virtualMachineResourceId string = createVirtualMachine ? virtualMachine.outputs.resourceId : ''
+
+@description('The name of the virtual machine.')
+output virtualMachineName string = createVirtualMachine ? virtualMachine.outputs.name : ''
+
 // ================ //
 // Definitions      //
 // ================ //
 
-type managedIdentitySettingType = {
-  @description('Optional. The name of the user-assigned managed identity.')
-  name: string?
+type managedIdentityConfigurationType = {
+  @description('Optional. The name of the workspace hub user-assigned managed identity.')
+  hubName: string?
+
+  @description('Optional. The name of the workspace project user-assigned managed identity.')
+  projectName: string?
 }?
 
-type logAnalyticsSettingType = {
+type logAnalyticsConfigurationType = {
   @description('Optional. The name of the Log Analytics workspace.')
   name: string?
 }?
 
-type keyVaultSettingType = {
+type keyVaultConfigurationType = {
   @description('Optional. The name of the key vault.')
   name: string?
 
@@ -319,7 +718,7 @@ type keyVaultSettingType = {
   enablePurgeProtection: bool?
 }?
 
-type storageAccountSettingType = {
+type storageAccountConfigurationType = {
   @description('Optional. The name of the storage account.')
   name: string?
 
@@ -338,7 +737,7 @@ type storageAccountSettingType = {
   allowSharedKeyAccess: bool?
 }?
 
-type containerRegistrySettingType = {
+type containerRegistryConfigurationType = {
   @description('Optional. The name of the container registry.')
   name: string?
 
@@ -346,15 +745,18 @@ type containerRegistrySettingType = {
   trustPolicyStatus: 'enabled' | 'disabled'?
 }?
 
-type applicationInsightsSettingType = {
+type applicationInsightsConfigurationType = {
   @description('Optional. The name of the Application Insights resource.')
   name: string?
 }?
 
-type workspaceHubSettingType = {
+type workspaceConfigurationType = {
   @description('Optional. The name of the AI Studio workspace hub.')
   name: string?
 
+  @description('Optional. The name of the AI Studio workspace project.')
+  projectName: string?
+
   @description('Optional. Computes to create and attach to the workspace hub.')
   computes: array?
 
@@ -365,6 +767,159 @@ type workspaceHubSettingType = {
   networkOutboundRules: networkOutboundRuleType
 }?
 
+type virtualNetworkSubnetConfigurationType = {
+  @description('Optional. The name of the subnet to create.')
+  name: string?
+
+  @description('Optional. The address prefix of the subnet to create.')
+  addressPrefix: string?
+
+  @description('Optional. The resource ID of an existing network security group to associate with the subnet.')
+  networkSecurityGroupResourceId: string?
+}?
+
+type virtualNetworkConfigurationType = {
+  @description('Optional. Whether to create an associated virtual network. Defaults to \'true\'.')
+  enabled: bool?
+
+  @description('Optional. The name of the virtual network to create.')
+  name: string?
+
+  @description('Optional. The address prefix of the virtual network to create.')
+  addressPrefix: string?
+
+  @description('Optional. Configuration for the virual network subnet.')
+  subnet: virtualNetworkSubnetConfigurationType
+}?
+
+type bastionConfigurationType = {
+  @description('Optional. Whether to create a Bastion host in the virtual network. Defaults to \'true\'.')
+  enabled: bool?
+
+  @description('Optional. The name of the Bastion host to create.')
+  name: string?
+
+  @description('Optional. The SKU of the Bastion host to create.')
+  sku: 'Basic' | 'Standard'?
+
+  @description('Optional. The resource ID of an existing network security group to associate with the Azure Bastion subnet.')
+  networkSecurityGroupResourceId: string?
+
+  @description('Optional. The address prefix of the Azure Bastion subnet.')
+  subnetAddressPrefix: string?
+
+  @description('Optional. Choose to disable or enable Copy Paste.')
+  disableCopyPaste: bool?
+
+  @description('Optional. Choose to disable or enable File Copy.')
+  enableFileCopy: bool?
+
+  @description('Optional. Choose to disable or enable IP Connect.')
+  enableIpConnect: bool?
+
+  @description('Optional. Choose to disable or enable Kerberos authentication.')
+  enableKerberos: bool?
+
+  @description('Optional. Choose to disable or enable Shareable Link.')
+  enableShareableLink: bool?
+
+  @description('Optional. The scale units for the Bastion Host resource.')
+  scaleUnits: int?
+}?
+
+type nicConfigurationConfigurationType = {
+  @description('Optional. The name of the network interface.')
+  name: string?
+
+  @description('Optional. The name of the IP configuration.')
+  ipConfigName: string?
+
+  @description('Optional. The private IP address allocation method.')
+  privateIPAllocationMethod: 'Dynamic' | 'Static'?
+
+  @description('Optional. The resource ID of an existing network security group to associate with the network interface.')
+  networkSecurityGroupResourceId: string?
+}?
+
+type osDiskType = {
+  @description('Optional. The disk name.')
+  name: string?
+
+  @description('Optional. Specifies the size of an empty data disk in gigabytes.')
+  diskSizeGB: int?
+
+  @description('Optional. Specifies how the virtual machine should be created.')
+  createOption: 'Attach' | 'Empty' | 'FromImage'?
+
+  @description('Optional. Specifies whether data disk should be deleted or detached upon VM deletion.')
+  deleteOption: 'Delete' | 'Detach'?
+
+  @description('Optional. Specifies the caching requirements.')
+  caching: 'None' | 'ReadOnly' | 'ReadWrite'?
+
+  @description('Required. The managed disk parameters.')
+  managedDisk: {
+    @description('Optional. Specifies the storage account type for the managed disk.')
+    storageAccountType:
+      | 'PremiumV2_LRS'
+      | 'Premium_LRS'
+      | 'Premium_ZRS'
+      | 'StandardSSD_LRS'
+      | 'StandardSSD_ZRS'
+      | 'Standard_LRS'
+      | 'UltraSSD_LRS'?
+
+    @description('Optional. Specifies the customer managed disk encryption set resource id for the managed disk.')
+    diskEncryptionSetResourceId: string?
+  }
+}?
+
+@secure()
+type virtualMachineConfigurationType = {
+  @description('Optional. Whether to create a virtual machine in the associated virtual network. Defaults to \'true\'.')
+  enabled: bool?
+
+  @description('Optional. The name of the virtual machine.')
+  @maxLength(15)
+  name: string?
+
+  @description('Optional. The availability zone of the virtual machine. If set to 0, no availability zone is used (default).')
+  zone: 0 | 1 | 2 | 3?
+
+  @description('Required. The virtual machine size. Defaults to \'Standard_D2s_v3\'.')
+  size: string?
+
+  @description('Conditional. The username for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module.')
+  adminUsername: string?
+
+  @description('Conditional. The password for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module.')
+  adminPassword: string?
+
+  @description('Optional. Configuration for the virtual machine network interface.')
+  nicConfigurationConfiguration: nicConfigurationConfigurationType
+
+  @description('Optional. OS image reference. In case of marketplace images, it\'s the combination of the publisher, offer, sku, version attributes. In case of custom images it\'s the resource ID of the custom image.')
+  imageReference: object?
+
+  @description('Optional. Specifies the OS disk.')
+  osDisk: osDiskType
+
+  @description('Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to \'true\'.')
+  encryptionAtHost: bool?
+
+  @description('Optional. VM guest patching orchestration mode. Refer to \'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching\'.')
+  patchMode: 'AutomaticByPlatform' | 'AutomaticByOS' | 'Manual'?
+
+  @description('Optional. Whether to enable the Microsoft.Azure.ActiveDirectory AADLoginForWindows extension, allowing users to log in to the virtual machine using Microsoft Entra. Defaults to \'false\'.')
+  enableAadLoginExtension: bool?
+
+  @description('Optional. Whether to enable the Microsoft.Azure.Monitor AzureMonitorWindowsAgent extension. Defaults to \'false\'.')
+  enableAzureMonitorAgent: bool?
+
+  @description('Optional. The resource Id of a maintenance configuration for the virtual machine.')
+  maintenanceConfigurationResourceId: string?
+}?
+
 @discriminator('type')
 type OutboundRuleType = FqdnOutboundRuleType | PrivateEndpointOutboundRule | ServiceTagOutboundRule
 
diff --git a/avm/ptn/ai-platform/baseline/main.json b/avm/ptn/ai-platform/baseline/main.json
index 4700db7948..4fe65a2d83 100644
--- a/avm/ptn/ai-platform/baseline/main.json
+++ b/avm/ptn/ai-platform/baseline/main.json
@@ -5,28 +5,35 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "5295105526261287079"
+      "version": "0.29.47.4906",
+      "templateHash": "2263138345896714301"
     },
     "name": "AI Platform Baseline",
     "description": "This module provides a secure and scalable environment for deploying AI applications on Azure.\nThe module encompasses all essential components required for building, managing, and observing AI solutions, including a machine learning workspace, observability tools, and necessary data management services.\nBy integrating with Microsoft Entra ID for secure identity management and utilizing private endpoints for services like Key Vault and Blob Storage, the module ensures secure communication and data access.",
     "owner": "Azure/module-maintainers"
   },
   "definitions": {
-    "managedIdentitySettingType": {
+    "managedIdentityConfigurationType": {
       "type": "object",
       "properties": {
-        "name": {
+        "hubName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the workspace hub user-assigned managed identity."
+          }
+        },
+        "projectName": {
           "type": "string",
           "nullable": true,
           "metadata": {
-            "description": "Optional. The name of the user-assigned managed identity."
+            "description": "Optional. The name of the workspace project user-assigned managed identity."
           }
         }
       },
       "nullable": true
     },
-    "logAnalyticsSettingType": {
+    "logAnalyticsConfigurationType": {
       "type": "object",
       "properties": {
         "name": {
@@ -39,7 +46,7 @@
       },
       "nullable": true
     },
-    "keyVaultSettingType": {
+    "keyVaultConfigurationType": {
       "type": "object",
       "properties": {
         "name": {
@@ -59,7 +66,7 @@
       },
       "nullable": true
     },
-    "storageAccountSettingType": {
+    "storageAccountConfigurationType": {
       "type": "object",
       "properties": {
         "name": {
@@ -96,7 +103,7 @@
       },
       "nullable": true
     },
-    "containerRegistrySettingType": {
+    "containerRegistryConfigurationType": {
       "type": "object",
       "properties": {
         "name": {
@@ -120,7 +127,7 @@
       },
       "nullable": true
     },
-    "applicationInsightsSettingType": {
+    "applicationInsightsConfigurationType": {
       "type": "object",
       "properties": {
         "name": {
@@ -133,7 +140,7 @@
       },
       "nullable": true
     },
-    "workspaceHubSettingType": {
+    "workspaceConfigurationType": {
       "type": "object",
       "properties": {
         "name": {
@@ -143,6 +150,13 @@
             "description": "Optional. The name of the AI Studio workspace hub."
           }
         },
+        "projectName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the AI Studio workspace project."
+          }
+        },
         "computes": {
           "type": "array",
           "nullable": true,
@@ -170,179 +184,564 @@
       },
       "nullable": true
     },
-    "OutboundRuleType": {
+    "virtualNetworkSubnetConfigurationType": {
       "type": "object",
-      "discriminator": {
-        "propertyName": "type",
-        "mapping": {
-          "FQDN": {
-            "$ref": "#/definitions/FqdnOutboundRuleType"
-          },
-          "PrivateEndpoint": {
-            "$ref": "#/definitions/PrivateEndpointOutboundRule"
-          },
-          "ServiceTag": {
-            "$ref": "#/definitions/ServiceTagOutboundRule"
+      "properties": {
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the subnet to create."
+          }
+        },
+        "addressPrefix": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The address prefix of the subnet to create."
+          }
+        },
+        "networkSecurityGroupResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of an existing network security group to associate with the subnet."
           }
         }
-      }
+      },
+      "nullable": true
     },
-    "FqdnOutboundRuleType": {
+    "virtualNetworkConfigurationType": {
       "type": "object",
       "properties": {
-        "type": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Whether to create an associated virtual network. Defaults to 'true'."
+          }
+        },
+        "name": {
           "type": "string",
-          "allowedValues": [
-            "FQDN"
-          ],
+          "nullable": true,
           "metadata": {
-            "description": "Required. Type of a managed network Outbound Rule of the  workspace hub. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound'."
+            "description": "Optional. The name of the virtual network to create."
           }
         },
-        "destination": {
+        "addressPrefix": {
           "type": "string",
+          "nullable": true,
           "metadata": {
-            "description": "Required. Fully Qualified Domain Name to allow for outbound traffic."
+            "description": "Optional. The address prefix of the virtual network to create."
           }
         },
-        "category": {
+        "subnet": {
+          "$ref": "#/definitions/virtualNetworkSubnetConfigurationType",
+          "metadata": {
+            "description": "Optional. Configuration for the virual network subnet."
+          }
+        }
+      },
+      "nullable": true
+    },
+    "bastionConfigurationType": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Whether to create a Bastion host in the virtual network. Defaults to 'true'."
+          }
+        },
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The name of the Bastion host to create."
+          }
+        },
+        "sku": {
           "type": "string",
           "allowedValues": [
-            "Dependency",
-            "Recommended",
-            "Required",
-            "UserDefined"
+            "Basic",
+            "Standard"
           ],
           "nullable": true,
           "metadata": {
-            "description": "Optional. Category of a managed network Outbound Rule of the workspace hub."
+            "description": "Optional. The SKU of the Bastion host to create."
+          }
+        },
+        "networkSecurityGroupResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of an existing network security group to associate with the Azure Bastion subnet."
+          }
+        },
+        "subnetAddressPrefix": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The address prefix of the Azure Bastion subnet."
+          }
+        },
+        "disableCopyPaste": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Choose to disable or enable Copy Paste."
+          }
+        },
+        "enableFileCopy": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Choose to disable or enable File Copy."
+          }
+        },
+        "enableIpConnect": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Choose to disable or enable IP Connect."
+          }
+        },
+        "enableKerberos": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Choose to disable or enable Kerberos authentication."
+          }
+        },
+        "enableShareableLink": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Choose to disable or enable Shareable Link."
+          }
+        },
+        "scaleUnits": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The scale units for the Bastion Host resource."
           }
         }
-      }
+      },
+      "nullable": true
     },
-    "PrivateEndpointOutboundRule": {
+    "nicConfigurationConfigurationType": {
       "type": "object",
       "properties": {
-        "type": {
+        "name": {
           "type": "string",
-          "allowedValues": [
-            "PrivateEndpoint"
-          ],
+          "nullable": true,
           "metadata": {
-            "description": "Required. Type of a managed network Outbound Rule of the workspace hub."
+            "description": "Optional. The name of the network interface."
           }
         },
-        "destination": {
-          "type": "object",
-          "properties": {
-            "serviceResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The resource ID of the target resource for the private endpoint."
-              }
-            },
-            "sparkEnabled": {
-              "type": "bool",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Whether the private endpoint can be used by jobs running on Spark."
-              }
-            },
-            "subresourceTarget": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The sub resource to connect for the private endpoint."
-              }
-            }
-          },
+        "ipConfigName": {
+          "type": "string",
+          "nullable": true,
           "metadata": {
-            "description": "Required. Service Tag destination for a Service Tag Outbound Rule for the managed network of the workspace hub."
+            "description": "Optional. The name of the IP configuration."
           }
         },
-        "category": {
+        "privateIPAllocationMethod": {
           "type": "string",
           "allowedValues": [
-            "Dependency",
-            "Recommended",
-            "Required",
-            "UserDefined"
+            "Dynamic",
+            "Static"
           ],
           "nullable": true,
           "metadata": {
-            "description": "Optional. Category of a managed network Outbound Rule of the workspace hub."
+            "description": "Optional. The private IP address allocation method."
+          }
+        },
+        "networkSecurityGroupResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of an existing network security group to associate with the network interface."
           }
         }
-      }
+      },
+      "nullable": true
     },
-    "ServiceTagOutboundRule": {
+    "osDiskType": {
       "type": "object",
       "properties": {
-        "type": {
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The disk name."
+          }
+        },
+        "diskSizeGB": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specifies the size of an empty data disk in gigabytes."
+          }
+        },
+        "createOption": {
           "type": "string",
           "allowedValues": [
-            "ServiceTag"
+            "Attach",
+            "Empty",
+            "FromImage"
           ],
+          "nullable": true,
           "metadata": {
-            "description": "Required. Type of a managed network Outbound Rule of the workspace hub. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound'."
+            "description": "Optional. Specifies how the virtual machine should be created."
           }
         },
-        "destination": {
+        "deleteOption": {
+          "type": "string",
+          "allowedValues": [
+            "Delete",
+            "Detach"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+          }
+        },
+        "caching": {
+          "type": "string",
+          "allowedValues": [
+            "None",
+            "ReadOnly",
+            "ReadWrite"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specifies the caching requirements."
+          }
+        },
+        "managedDisk": {
           "type": "object",
           "properties": {
-            "portRanges": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The name of the service tag to allow."
-              }
-            },
-            "protocol": {
+            "storageAccountType": {
               "type": "string",
               "allowedValues": [
-                "*",
-                "ICMP",
-                "TCP",
-                "UDP"
+                "PremiumV2_LRS",
+                "Premium_LRS",
+                "Premium_ZRS",
+                "StandardSSD_LRS",
+                "StandardSSD_ZRS",
+                "Standard_LRS",
+                "UltraSSD_LRS"
               ],
+              "nullable": true,
               "metadata": {
-                "description": "Required. The protocol to allow. Provide an asterisk(*) to allow any protocol."
+                "description": "Optional. Specifies the storage account type for the managed disk."
               }
             },
-            "serviceTag": {
+            "diskEncryptionSetResourceId": {
               "type": "string",
+              "nullable": true,
               "metadata": {
-                "description": "Required. Which ports will be allow traffic by this rule. Provide an asterisk(*) to allow any port."
+                "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
               }
             }
           },
           "metadata": {
-            "description": "Required. Service Tag destination for a Service Tag Outbound Rule for the managed network of the workspace hub."
+            "description": "Required. The managed disk parameters."
+          }
+        }
+      },
+      "nullable": true
+    },
+    "virtualMachineConfigurationType": {
+      "type": "secureObject",
+      "properties": {
+        "enabled": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Whether to create a virtual machine in the associated virtual network. Defaults to 'true'."
           }
         },
-        "category": {
+        "name": {
           "type": "string",
+          "nullable": true,
+          "maxLength": 15,
+          "metadata": {
+            "description": "Optional. The name of the virtual machine."
+          }
+        },
+        "zone": {
+          "type": "int",
           "allowedValues": [
-            "Dependency",
-            "Recommended",
-            "Required",
-            "UserDefined"
+            0,
+            1,
+            2,
+            3
           ],
           "nullable": true,
           "metadata": {
-            "description": "Optional. Category of a managed network Outbound Rule of the workspace hub."
+            "description": "Optional. The availability zone of the virtual machine. If set to 0, no availability zone is used (default)."
           }
-        }
-      }
-    },
-    "networkOutboundRuleType": {
-      "type": "object",
-      "properties": {},
-      "additionalProperties": {
-        "$ref": "#/definitions/OutboundRuleType",
-        "metadata": {
-          "description": "Required. The outbound rule. The name of the rule is the object key."
-        }
-      },
-      "nullable": true,
+        },
+        "size": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Required. The virtual machine size. Defaults to 'Standard_D2s_v3'."
+          }
+        },
+        "adminUsername": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The username for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module."
+          }
+        },
+        "adminPassword": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The password for the administrator account on the virtual machine. Required if a virtual machine is created as part of the module."
+          }
+        },
+        "nicConfigurationConfiguration": {
+          "$ref": "#/definitions/nicConfigurationConfigurationType",
+          "metadata": {
+            "description": "Optional. Configuration for the virtual machine network interface."
+          }
+        },
+        "imageReference": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image."
+          }
+        },
+        "osDisk": {
+          "$ref": "#/definitions/osDiskType",
+          "metadata": {
+            "description": "Optional. Specifies the OS disk."
+          }
+        },
+        "encryptionAtHost": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to 'true'."
+          }
+        },
+        "patchMode": {
+          "type": "string",
+          "allowedValues": [
+            "AutomaticByOS",
+            "AutomaticByPlatform",
+            "Manual"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. VM guest patching orchestration mode. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+          }
+        },
+        "enableAadLoginExtension": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Whether to enable the Microsoft.Azure.ActiveDirectory AADLoginForWindows extension, allowing users to log in to the virtual machine using Microsoft Entra. Defaults to 'false'."
+          }
+        },
+        "enableAzureMonitorAgent": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Whether to enable the Microsoft.Azure.Monitor AzureMonitorWindowsAgent extension. Defaults to 'false'."
+          }
+        },
+        "maintenanceConfigurationResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource Id of a maintenance configuration for the virtual machine."
+          }
+        }
+      },
+      "nullable": true
+    },
+    "OutboundRuleType": {
+      "type": "object",
+      "discriminator": {
+        "propertyName": "type",
+        "mapping": {
+          "FQDN": {
+            "$ref": "#/definitions/FqdnOutboundRuleType"
+          },
+          "PrivateEndpoint": {
+            "$ref": "#/definitions/PrivateEndpointOutboundRule"
+          },
+          "ServiceTag": {
+            "$ref": "#/definitions/ServiceTagOutboundRule"
+          }
+        }
+      }
+    },
+    "FqdnOutboundRuleType": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "allowedValues": [
+            "FQDN"
+          ],
+          "metadata": {
+            "description": "Required. Type of a managed network Outbound Rule of the  workspace hub. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound'."
+          }
+        },
+        "destination": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. Fully Qualified Domain Name to allow for outbound traffic."
+          }
+        },
+        "category": {
+          "type": "string",
+          "allowedValues": [
+            "Dependency",
+            "Recommended",
+            "Required",
+            "UserDefined"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Category of a managed network Outbound Rule of the workspace hub."
+          }
+        }
+      }
+    },
+    "PrivateEndpointOutboundRule": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "allowedValues": [
+            "PrivateEndpoint"
+          ],
+          "metadata": {
+            "description": "Required. Type of a managed network Outbound Rule of the workspace hub."
+          }
+        },
+        "destination": {
+          "type": "object",
+          "properties": {
+            "serviceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The resource ID of the target resource for the private endpoint."
+              }
+            },
+            "sparkEnabled": {
+              "type": "bool",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Whether the private endpoint can be used by jobs running on Spark."
+              }
+            },
+            "subresourceTarget": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The sub resource to connect for the private endpoint."
+              }
+            }
+          },
+          "metadata": {
+            "description": "Required. Service Tag destination for a Service Tag Outbound Rule for the managed network of the workspace hub."
+          }
+        },
+        "category": {
+          "type": "string",
+          "allowedValues": [
+            "Dependency",
+            "Recommended",
+            "Required",
+            "UserDefined"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Category of a managed network Outbound Rule of the workspace hub."
+          }
+        }
+      }
+    },
+    "ServiceTagOutboundRule": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "allowedValues": [
+            "ServiceTag"
+          ],
+          "metadata": {
+            "description": "Required. Type of a managed network Outbound Rule of the workspace hub. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound'."
+          }
+        },
+        "destination": {
+          "type": "object",
+          "properties": {
+            "portRanges": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the service tag to allow."
+              }
+            },
+            "protocol": {
+              "type": "string",
+              "allowedValues": [
+                "*",
+                "ICMP",
+                "TCP",
+                "UDP"
+              ],
+              "metadata": {
+                "description": "Required. The protocol to allow. Provide an asterisk(*) to allow any protocol."
+              }
+            },
+            "serviceTag": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Which ports will be allow traffic by this rule. Provide an asterisk(*) to allow any port."
+              }
+            }
+          },
+          "metadata": {
+            "description": "Required. Service Tag destination for a Service Tag Outbound Rule for the managed network of the workspace hub."
+          }
+        },
+        "category": {
+          "type": "string",
+          "allowedValues": [
+            "Dependency",
+            "Recommended",
+            "Required",
+            "UserDefined"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Category of a managed network Outbound Rule of the workspace hub."
+          }
+        }
+      }
+    },
+    "networkOutboundRuleType": {
+      "type": "object",
+      "properties": {},
+      "additionalProperties": {
+        "$ref": "#/definitions/OutboundRuleType",
+        "metadata": {
+          "description": "Required. The outbound rule. The name of the rule is the object key."
+        }
+      },
+      "nullable": true,
       "metadata": {
         "description": "Optional. Outbound rules for the managed network of the workspace hub."
       }
@@ -377,50 +776,114 @@
         "description": "Optional. Enable/Disable usage telemetry for module."
       }
     },
-    "managedIdentitySettings": {
-      "$ref": "#/definitions/managedIdentitySettingType",
+    "managedIdentityConfiguration": {
+      "$ref": "#/definitions/managedIdentityConfigurationType",
+      "metadata": {
+        "description": "Optional. Configuration for the user-assigned managed identities."
+      }
+    },
+    "logAnalyticsConfiguration": {
+      "$ref": "#/definitions/logAnalyticsConfigurationType",
+      "metadata": {
+        "description": "Optional. Configuration for the Log Analytics workspace."
+      }
+    },
+    "keyVaultConfiguration": {
+      "$ref": "#/definitions/keyVaultConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for the user-assigned managed identity."
+        "description": "Optional. Configuration for the key vault."
       }
     },
-    "logAnalyticsSettings": {
-      "$ref": "#/definitions/logAnalyticsSettingType",
+    "storageAccountConfiguration": {
+      "$ref": "#/definitions/storageAccountConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for the Log Analytics workspace."
+        "description": "Optional. Configuration for the storage account."
       }
     },
-    "keyVaultSettings": {
-      "$ref": "#/definitions/keyVaultSettingType",
+    "containerRegistryConfiguration": {
+      "$ref": "#/definitions/containerRegistryConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for the key vault."
+        "description": "Optional. Configuration for the container registry."
       }
     },
-    "storageAccountSettings": {
-      "$ref": "#/definitions/storageAccountSettingType",
+    "applicationInsightsConfiguration": {
+      "$ref": "#/definitions/applicationInsightsConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for the storage account."
+        "description": "Optional. Configuration for Application Insights."
       }
     },
-    "containerRegistrySettings": {
-      "$ref": "#/definitions/containerRegistrySettingType",
+    "workspaceConfiguration": {
+      "$ref": "#/definitions/workspaceConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for the container registry."
+        "description": "Optional. Configuration for the AI Studio workspace."
       }
     },
-    "applicationInsightsSettings": {
-      "$ref": "#/definitions/applicationInsightsSettingType",
+    "virtualNetworkConfiguration": {
+      "$ref": "#/definitions/virtualNetworkConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for Application Insights."
+        "description": "Optional. Configuration for the virtual network."
       }
     },
-    "workspaceHubSettings": {
-      "$ref": "#/definitions/workspaceHubSettingType",
+    "bastionConfiguration": {
+      "$ref": "#/definitions/bastionConfigurationType",
       "metadata": {
-        "description": "Optional. Settings for the AI Studio workspace hub."
+        "description": "Optional. Configuration for the Azure Bastion host."
       }
+    },
+    "virtualMachineConfiguration": {
+      "$ref": "#/definitions/virtualMachineConfigurationType",
+      "metadata": {
+        "description": "Optional. Configuration for the virtual machine."
+      }
+    }
+  },
+  "variables": {
+    "createVirtualNetwork": "[not(equals(tryGet(parameters('virtualNetworkConfiguration'), 'enabled'), false()))]",
+    "createBastion": "[and(variables('createVirtualNetwork'), not(equals(tryGet(parameters('bastionConfiguration'), 'enabled'), false())))]",
+    "createVirtualMachine": "[and(variables('createVirtualNetwork'), not(equals(tryGet(parameters('virtualMachineConfiguration'), 'enabled'), false())))]",
+    "createDefaultNsg": "[equals(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'networkSecurityGroupResourceId'), null())]",
+    "subnetResourceId": "[if(variables('createVirtualNetwork'), resourceId('Microsoft.Network/virtualNetworks/subnets', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))), coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'name'), 'default')), null())]",
+    "mlTargetSubResource": "amlworkspace",
+    "mlPrivateDnsZones": {
+      "privatelink.api.azureml.ms": "[variables('mlTargetSubResource')]",
+      "privatelink.notebooks.azure.net": "[variables('mlTargetSubResource')]"
+    },
+    "storagePrivateDnsZones": {
+      "[format('privatelink.blob.{0}', environment().suffixes.storage)]": "blob",
+      "[format('privatelink.file.{0}', environment().suffixes.storage)]": "file"
     }
   },
   "resources": {
+    "virtualNetwork::defaultSubnet": {
+      "condition": "[variables('createVirtualNetwork')]",
+      "type": "Microsoft.Network/virtualNetworks/subnets",
+      "apiVersion": "2024-01-01",
+      "name": "[format('{0}/{1}', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))), coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'name'), 'default'))]",
+      "properties": {
+        "addressPrefix": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'addressPrefix'), '10.0.0.0/24')]",
+        "networkSecurityGroup": {
+          "id": "[if(variables('createDefaultNsg'), reference('defaultNetworkSecurityGroup').outputs.resourceId.value, tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'networkSecurityGroupResourceId'))]"
+        }
+      },
+      "dependsOn": [
+        "defaultNetworkSecurityGroup",
+        "virtualNetwork"
+      ]
+    },
+    "virtualNetwork::bastionSubnet": {
+      "condition": "[and(variables('createVirtualNetwork'), variables('createBastion'))]",
+      "type": "Microsoft.Network/virtualNetworks/subnets",
+      "apiVersion": "2024-01-01",
+      "name": "[format('{0}/{1}', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))), 'AzureBastionSubnet')]",
+      "properties": {
+        "addressPrefix": "[coalesce(tryGet(parameters('bastionConfiguration'), 'subnetAddressPrefix'), '10.0.1.0/26')]",
+        "networkSecurityGroup": "[if(not(equals(tryGet(parameters('bastionConfiguration'), 'networkSecurityGroupResourceId'), null())), createObject('id', tryGet(parameters('bastionConfiguration'), 'networkSecurityGroupResourceId')), null())]"
+      },
+      "dependsOn": [
+        "virtualNetwork::defaultSubnet",
+        "virtualNetwork"
+      ]
+    },
     "avmTelemetry": {
       "condition": "[parameters('enableTelemetry')]",
       "type": "Microsoft.Resources/deployments",
@@ -441,24 +904,64 @@
         }
       }
     },
-    "managedIdentity": {
-      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-      "apiVersion": "2023-01-31",
-      "name": "[coalesce(tryGet(parameters('managedIdentitySettings'), 'name'), format('id-{0}', parameters('name')))]",
+    "virtualNetwork": {
+      "condition": "[variables('createVirtualNetwork')]",
+      "type": "Microsoft.Network/virtualNetworks",
+      "apiVersion": "2024-01-01",
+      "name": "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name')))]",
       "location": "[parameters('location')]",
-      "tags": "[parameters('tags')]"
+      "tags": "[parameters('tags')]",
+      "properties": {
+        "addressSpace": {
+          "addressPrefixes": [
+            "[coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'addressPrefix'), '10.0.0.0/16')]"
+          ]
+        }
+      }
+    },
+    "managedIdentityHub": {
+      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+      "apiVersion": "2023-01-31",
+      "name": "[coalesce(tryGet(parameters('managedIdentityConfiguration'), 'hubName'), format('id-hub-{0}', parameters('name')))]",
+      "location": "[parameters('location')]",
+      "tags": "[parameters('tags')]"
+    },
+    "managedIdentityProject": {
+      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+      "apiVersion": "2023-01-31",
+      "name": "[coalesce(tryGet(parameters('managedIdentityConfiguration'), 'projectName'), format('id-project-{0}', parameters('name')))]",
+      "location": "[parameters('location')]",
+      "tags": "[parameters('tags')]"
     },
     "logAnalyticsWorkspace": {
       "type": "Microsoft.OperationalInsights/workspaces",
       "apiVersion": "2023-09-01",
-      "name": "[coalesce(tryGet(parameters('logAnalyticsSettings'), 'name'), format('log-{0}', parameters('name')))]",
+      "name": "[coalesce(tryGet(parameters('logAnalyticsConfiguration'), 'name'), format('log-{0}', parameters('name')))]",
       "location": "[parameters('location')]",
       "tags": "[parameters('tags')]"
     },
-    "keyVault": {
+    "resourceGroup_roleAssignment": {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "name": "[guid(resourceGroup().id, parameters('name'))]",
+      "properties": {
+        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+        "principalId": "[reference('managedIdentityHub').principalId]",
+        "principalType": "ServicePrincipal"
+      },
+      "dependsOn": [
+        "managedIdentityHub"
+      ]
+    },
+    "storageAccount_privateDnsZones": {
+      "copy": {
+        "name": "storageAccount_privateDnsZones",
+        "count": "[length(objectKeys(variables('storagePrivateDnsZones')))]"
+      },
+      "condition": "[variables('createVirtualNetwork')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-key-vault', uniqueString(deployment().name, parameters('location')))]",
+      "name": "[format('{0}-storage-private-dns-zones', uniqueString(deployment().name, parameters('location'), objectKeys(variables('storagePrivateDnsZones'))[copyIndex()]))]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
@@ -466,65 +969,14 @@
         "mode": "Incremental",
         "parameters": {
           "name": {
-            "value": "[coalesce(tryGet(parameters('keyVaultSettings'), 'name'), format('kv-{0}', parameters('name')))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "enableRbacAuthorization": {
-            "value": true
-          },
-          "enableVaultForDeployment": {
-            "value": false
-          },
-          "enableVaultForDiskEncryption": {
-            "value": false
-          },
-          "enableVaultForTemplateDeployment": {
-            "value": false
-          },
-          "networkAcls": {
-            "value": {
-              "defaultAction": "Deny",
-              "bypass": "AzureServices"
-            }
-          },
-          "publicNetworkAccess": {
-            "value": "Disabled"
+            "value": "[objectKeys(variables('storagePrivateDnsZones'))[copyIndex()]]"
           },
-          "enablePurgeProtection": {
-            "value": "[coalesce(tryGet(parameters('keyVaultSettings'), 'enablePurgeProtection'), true())]"
-          },
-          "roleAssignments": {
-            "value": [
-              {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Contributor"
-              },
-              {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Key Vault Administrator"
-              }
-            ]
-          },
-          "diagnosticSettings": {
+          "virtualNetworkLinks": {
             "value": [
               {
-                "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', coalesce(tryGet(parameters('logAnalyticsSettings'), 'name'), format('log-{0}', parameters('name'))))]",
-                "logCategoriesAndGroups": [
-                  {
-                    "category": "AuditEvent",
-                    "enabled": true
-                  }
-                ]
+                "virtualNetworkResourceId": "[resourceId('Microsoft.Network/virtualNetworks', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))))]"
               }
             ]
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
           }
         },
         "template": {
@@ -535,133 +987,13 @@
             "_generator": {
               "name": "bicep",
               "version": "0.28.1.47646",
-              "templateHash": "6639574961348492362"
+              "templateHash": "13567552508326841182"
             },
-            "name": "Key Vaults",
-            "description": "This module deploys a Key Vault.",
+            "name": "Private DNS Zones",
+            "description": "This module deploys a Private DNS zone.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
-            "diagnosticSettingType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of diagnostic setting."
-                    }
-                  },
-                  "logCategoriesAndGroups": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "category": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                          }
-                        },
-                        "categoryGroup": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                          }
-                        },
-                        "enabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                    }
-                  },
-                  "metricCategories": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "category": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                          }
-                        },
-                        "enabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                    }
-                  },
-                  "logAnalyticsDestinationType": {
-                    "type": "string",
-                    "allowedValues": [
-                      "AzureDiagnostics",
-                      "Dedicated"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                    }
-                  },
-                  "workspaceResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                    }
-                  },
-                  "storageAccountResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                    }
-                  },
-                  "eventHubAuthorizationRuleResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                    }
-                  },
-                  "eventHubName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                    }
-                  },
-                  "marketplacePartnerResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -728,170 +1060,160 @@
               },
               "nullable": true
             },
-            "privateEndpointType": {
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "aType": {
               "type": "array",
               "items": {
                 "type": "object",
                 "properties": {
                   "name": {
                     "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private endpoint."
-                    }
-                  },
-                  "location": {
-                    "type": "string",
-                    "nullable": true,
                     "metadata": {
-                      "description": "Optional. The location to deploy the private endpoint to."
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "privateLinkServiceConnectionName": {
-                    "type": "string",
+                  "metadata": {
+                    "type": "object",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The name of the private link connection to create."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "service": {
-                    "type": "string",
+                  "ttl": {
+                    "type": "int",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                      "description": "Optional. The TTL of the record."
                     }
                   },
-                  "subnetResourceId": {
-                    "type": "string",
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
                     "metadata": {
-                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      "description": "Optional. Array of role assignments to create."
                     }
                   },
-                  "privateDnsZoneGroupName": {
-                    "type": "string",
+                  "aRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ipv4Address": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IPv4 address of this A record."
+                          }
+                        }
+                      }
+                    },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                      "description": "Optional. The list of A records in the record set."
                     }
-                  },
-                  "privateDnsZoneResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    },
-                    "nullable": true,
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "aaaaType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
                     "metadata": {
-                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "isManualConnection": {
-                    "type": "bool",
+                  "metadata": {
+                    "type": "object",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. If Manual Private Link Connection is required."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "manualConnectionRequestMessage": {
-                    "type": "string",
+                  "ttl": {
+                    "type": "int",
                     "nullable": true,
-                    "maxLength": 140,
                     "metadata": {
-                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                      "description": "Optional. The TTL of the record."
                     }
                   },
-                  "customDnsConfigs": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Required. Fqdn that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
                     "metadata": {
-                      "description": "Optional. Custom DNS configurations."
+                      "description": "Optional. Array of role assignments to create."
                     }
                   },
-                  "ipConfigurations": {
+                  "aaaaRecords": {
                     "type": "array",
                     "items": {
                       "type": "object",
                       "properties": {
-                        "name": {
+                        "ipv6Address": {
                           "type": "string",
                           "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
+                            "description": "Required. The IPv6 address of this AAAA record."
                           }
                         }
                       }
                     },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      "description": "Optional. The list of AAAA records in the record set."
                     }
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    },
-                    "nullable": true,
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "cnameType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
                     "metadata": {
-                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "customNetworkInterfaceName": {
-                    "type": "string",
+                  "metadata": {
+                    "type": "object",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "lock": {
-                    "$ref": "#/definitions/lockType",
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
                     "metadata": {
-                      "description": "Optional. Specify the type of lock."
+                      "description": "Optional. The TTL of the record."
                     }
                   },
                   "roleAssignments": {
@@ -900,192 +1222,224 @@
                       "description": "Optional. Array of role assignments to create."
                     }
                   },
-                  "tags": {
+                  "cnameRecord": {
                     "type": "object",
+                    "properties": {
+                      "cname": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The canonical name of the CNAME record."
+                        }
+                      }
+                    },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      "description": "Optional. The CNAME record in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "mxType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "enableTelemetry": {
-                    "type": "bool",
+                  "metadata": {
+                    "type": "object",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Enable/Disable usage telemetry for module."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "resourceGroupName": {
-                    "type": "string",
+                  "ttl": {
+                    "type": "int",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "mxRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "exchange": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name of the mail host for this MX record."
+                          }
+                        },
+                        "preference": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The preference value for this MX record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of MX records in the record set."
                     }
                   }
                 }
               },
               "nullable": true
             },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
+            "ptrType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
                   "metadata": {
-                    "description": "Optional. Specify the type of lock."
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "ptrRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ptrdname": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The PTR target domain name for this PTR record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of PTR records in the record set."
+                    }
                   }
                 }
               },
               "nullable": true
             },
-            "accessPoliciesType": {
+            "soaType": {
               "type": "array",
               "items": {
                 "type": "object",
                 "properties": {
-                  "tenantId": {
+                  "name": {
                     "type": "string",
-                    "nullable": true,
                     "metadata": {
-                      "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "objectId": {
-                    "type": "string",
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
                     "metadata": {
-                      "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "applicationId": {
-                    "type": "string",
+                  "ttl": {
+                    "type": "int",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Application ID of the client making request on behalf of a principal."
+                      "description": "Optional. The TTL of the record."
                     }
                   },
-                  "permissions": {
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "soaRecord": {
                     "type": "object",
                     "properties": {
-                      "keys": {
-                        "type": "array",
-                        "allowedValues": [
-                          "all",
-                          "backup",
-                          "create",
-                          "decrypt",
-                          "delete",
-                          "encrypt",
-                          "get",
-                          "getrotationpolicy",
-                          "import",
-                          "list",
-                          "purge",
-                          "recover",
-                          "release",
-                          "restore",
-                          "rotate",
-                          "setrotationpolicy",
-                          "sign",
-                          "unwrapKey",
-                          "update",
-                          "verify",
-                          "wrapKey"
-                        ],
-                        "nullable": true,
+                      "email": {
+                        "type": "string",
                         "metadata": {
-                          "description": "Optional. Permissions to keys."
+                          "description": "Required. The email contact for this SOA record."
                         }
                       },
-                      "secrets": {
-                        "type": "array",
-                        "allowedValues": [
-                          "all",
-                          "backup",
-                          "delete",
-                          "get",
-                          "list",
-                          "purge",
-                          "recover",
-                          "restore",
-                          "set"
-                        ],
-                        "nullable": true,
+                      "expireTime": {
+                        "type": "int",
                         "metadata": {
-                          "description": "Optional. Permissions to secrets."
+                          "description": "Required. The expire time for this SOA record."
                         }
                       },
-                      "certificates": {
-                        "type": "array",
-                        "allowedValues": [
-                          "all",
-                          "backup",
-                          "create",
-                          "delete",
-                          "deleteissuers",
-                          "get",
-                          "getissuers",
-                          "import",
-                          "list",
-                          "listissuers",
-                          "managecontacts",
-                          "manageissuers",
-                          "purge",
-                          "recover",
-                          "restore",
-                          "setissuers",
-                          "update"
-                        ],
-                        "nullable": true,
+                      "host": {
+                        "type": "string",
                         "metadata": {
-                          "description": "Optional. Permissions to certificates."
+                          "description": "Required. The domain name of the authoritative name server for this SOA record."
                         }
                       },
-                      "storage": {
-                        "type": "array",
-                        "allowedValues": [
-                          "all",
-                          "backup",
-                          "delete",
-                          "deletesas",
-                          "get",
-                          "getsas",
-                          "list",
-                          "listsas",
-                          "purge",
-                          "recover",
-                          "regeneratekey",
-                          "restore",
-                          "set",
-                          "setsas",
-                          "update"
-                        ],
-                        "nullable": true,
+                      "minimumTtl": {
+                        "type": "int",
                         "metadata": {
-                          "description": "Optional. Permissions to storage accounts."
+                          "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                        }
+                      },
+                      "refreshTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The refresh value for this SOA record."
+                        }
+                      },
+                      "retryTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The retry time for this SOA record."
+                        }
+                      },
+                      "serialNumber": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The serial number for this SOA record."
                         }
                       }
                     },
+                    "nullable": true,
                     "metadata": {
-                      "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                      "description": "Optional. The SOA record in the record set."
                     }
                   }
                 }
               },
               "nullable": true
             },
-            "secretsType": {
+            "srvType": {
               "type": "array",
               "items": {
                 "type": "object",
@@ -1093,71 +1447,70 @@
                   "name": {
                     "type": "string",
                     "metadata": {
-                      "description": "Required. The name of the secret."
-                    }
-                  },
-                  "tags": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource tags."
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "attributes": {
+                  "metadata": {
                     "type": "object",
-                    "properties": {
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Defines whether the secret is enabled or disabled."
-                        }
-                      },
-                      "exp": {
-                        "type": "int",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
-                        }
-                      },
-                      "nbf": {
-                        "type": "int",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
-                        }
-                      }
-                    },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Contains attributes of the secret."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "contentType": {
-                    "type": "string",
+                  "ttl": {
+                    "type": "int",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The content type of the secret."
+                      "description": "Optional. The TTL of the record."
                     }
                   },
-                  "value": {
-                    "type": "securestring",
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
                     "metadata": {
-                      "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                      "description": "Optional. Array of role assignments to create."
                     }
                   },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
+                  "srvRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "priority": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The priority value for this SRV record."
+                          }
+                        },
+                        "weight": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The weight value for this SRV record."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The port value for this SRV record."
+                          }
+                        },
+                        "target": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The target domain name for this SRV record."
+                          }
+                        }
+                      }
+                    },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Array of role assignments to create."
+                      "description": "Optional. The list of SRV records in the record set."
                     }
                   }
                 }
               },
               "nullable": true
             },
-            "keysType": {
+            "txtType": {
               "type": "array",
               "items": {
                 "type": "object",
@@ -1165,214 +1518,49 @@
                   "name": {
                     "type": "string",
                     "metadata": {
-                      "description": "Required. The name of the key."
+                      "description": "Required. The name of the record."
                     }
                   },
-                  "tags": {
+                  "metadata": {
                     "type": "object",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Resource tags."
+                      "description": "Optional. The metadata of the record."
                     }
                   },
-                  "attributes": {
-                    "type": "object",
-                    "properties": {
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Defines whether the key is enabled or disabled."
-                        }
-                      },
-                      "exp": {
-                        "type": "int",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
-                        }
-                      },
-                      "nbf": {
-                        "type": "int",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
-                        }
-                      }
-                    },
+                  "ttl": {
+                    "type": "int",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Contains attributes of the key."
+                      "description": "Optional. The TTL of the record."
                     }
                   },
-                  "curveName": {
-                    "type": "string",
-                    "allowedValues": [
-                      "P-256",
-                      "P-256K",
-                      "P-384",
-                      "P-521"
-                    ],
-                    "nullable": true,
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
                     "metadata": {
-                      "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"."
+                      "description": "Optional. Array of role assignments to create."
                     }
                   },
-                  "keyOps": {
+                  "txtRecords": {
                     "type": "array",
-                    "allowedValues": [
-                      "decrypt",
-                      "encrypt",
-                      "import",
-                      "release",
-                      "sign",
-                      "unwrapKey",
-                      "verify",
-                      "wrapKey"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The allowed operations on this key."
-                    }
-                  },
-                  "keySize": {
-                    "type": "int",
-                    "allowedValues": [
-                      2048,
-                      3072,
-                      4096
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"."
-                    }
-                  },
-                  "kty": {
-                    "type": "string",
-                    "allowedValues": [
-                      "EC",
-                      "EC-HSM",
-                      "RSA",
-                      "RSA-HSM"
-                    ],
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "value": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The text value of this TXT record."
+                          }
+                        }
+                      }
+                    },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The type of the key. Default is \"EC\"."
+                      "description": "Optional. The list of TXT records in the record set."
                     }
-                  },
-                  "releasePolicy": {
-                    "type": "object",
-                    "properties": {
-                      "contentType": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Content type and version of key release policy."
-                        }
-                      },
-                      "data": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Blob encoding the policy rules under which the key can be released."
-                        }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Key release policy."
-                    }
-                  },
-                  "rotationPolicy": {
-                    "$ref": "#/definitions/rotationPoliciesType",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Key rotation policy."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "rotationPoliciesType": {
-              "type": "object",
-              "properties": {
-                "attributes": {
-                  "type": "object",
-                  "properties": {
-                    "expiryTime": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The attributes of key rotation policy."
-                  }
-                },
-                "lifetimeActions": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "action": {
-                        "type": "object",
-                        "properties": {
-                          "type": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Notify",
-                              "Rotate"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The type of action."
-                            }
-                          }
-                        },
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The action of key rotation policy lifetimeAction."
-                        }
-                      },
-                      "trigger": {
-                        "type": "object",
-                        "properties": {
-                          "timeAfterCreate": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
-                            }
-                          },
-                          "timeBeforeExpiry": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
-                            }
-                          }
-                        },
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The trigger of key rotation policy lifetimeAction."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The lifetimeActions for key rotation action."
                   }
                 }
               },
@@ -1382,128 +1570,70 @@
           "parameters": {
             "name": {
               "type": "string",
-              "maxLength": 24,
-              "metadata": {
-                "description": "Required. Name of the Key Vault. Must be globally unique."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
-            },
-            "accessPolicies": {
-              "$ref": "#/definitions/accessPoliciesType",
-              "metadata": {
-                "description": "Optional. All access policies to create."
-              }
-            },
-            "secrets": {
-              "$ref": "#/definitions/secretsType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. All secrets to create."
-              }
-            },
-            "keys": {
-              "$ref": "#/definitions/keysType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. All keys to create."
-              }
-            },
-            "enableVaultForDeployment": {
-              "type": "bool",
-              "defaultValue": true,
               "metadata": {
-                "description": "Optional. Specifies if the vault is enabled for deployment by script or compute."
+                "description": "Required. Private DNS zone name."
               }
             },
-            "enableVaultForTemplateDeployment": {
-              "type": "bool",
-              "defaultValue": true,
+            "a": {
+              "$ref": "#/definitions/aType",
               "metadata": {
-                "description": "Optional. Specifies if the vault is enabled for a template deployment."
+                "description": "Optional. Array of A records."
               }
             },
-            "enableVaultForDiskEncryption": {
-              "type": "bool",
-              "defaultValue": true,
+            "aaaa": {
+              "$ref": "#/definitions/aaaaType",
               "metadata": {
-                "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios."
+                "description": "Optional. Array of AAAA records."
               }
             },
-            "enableSoftDelete": {
-              "type": "bool",
-              "defaultValue": true,
+            "cname": {
+              "$ref": "#/definitions/cnameType",
               "metadata": {
-                "description": "Optional. Switch to enable/disable Key Vault's soft delete feature."
+                "description": "Optional. Array of CNAME records."
               }
             },
-            "softDeleteRetentionInDays": {
-              "type": "int",
-              "defaultValue": 90,
+            "mx": {
+              "$ref": "#/definitions/mxType",
               "metadata": {
-                "description": "Optional. softDelete data retention days. It accepts >=7 and <=90."
+                "description": "Optional. Array of MX records."
               }
             },
-            "enableRbacAuthorization": {
-              "type": "bool",
-              "defaultValue": true,
+            "ptr": {
+              "$ref": "#/definitions/ptrType",
               "metadata": {
-                "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC."
+                "description": "Optional. Array of PTR records."
               }
             },
-            "createMode": {
-              "type": "string",
-              "defaultValue": "default",
+            "soa": {
+              "$ref": "#/definitions/soaType",
               "metadata": {
-                "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not. - recover or default."
+                "description": "Optional. Array of SOA records."
               }
             },
-            "enablePurgeProtection": {
-              "type": "bool",
-              "defaultValue": true,
+            "srv": {
+              "$ref": "#/definitions/srvType",
               "metadata": {
-                "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature."
+                "description": "Optional. Array of SRV records."
               }
             },
-            "sku": {
-              "type": "string",
-              "defaultValue": "premium",
-              "allowedValues": [
-                "premium",
-                "standard"
-              ],
+            "txt": {
+              "$ref": "#/definitions/txtType",
               "metadata": {
-                "description": "Optional. Specifies the SKU for the vault."
+                "description": "Optional. Array of TXT records."
               }
             },
-            "networkAcls": {
-              "type": "object",
+            "virtualNetworkLinks": {
+              "type": "array",
               "nullable": true,
               "metadata": {
-                "description": "Optional. Rules governing the accessibility of the resource from specific network locations."
+                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
               }
             },
-            "publicNetworkAccess": {
+            "location": {
               "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "",
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
+              "defaultValue": "global",
               "metadata": {
-                "description": "Optional. The lock settings of the service."
+                "description": "Optional. The location of the PrivateDNSZone. Should be global."
               }
             },
             "roleAssignments": {
@@ -1512,23 +1642,17 @@
                 "description": "Optional. Array of role assignments to create."
               }
             },
-            "privateEndpoints": {
-              "$ref": "#/definitions/privateEndpointType",
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-              }
-            },
             "tags": {
               "type": "object",
               "nullable": true,
               "metadata": {
-                "description": "Optional. Resource tags."
+                "description": "Optional. Tags of the resource."
               }
             },
-            "diagnosticSettings": {
-              "$ref": "#/definitions/diagnosticSettingType",
+            "lock": {
+              "$ref": "#/definitions/lockType",
               "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
+                "description": "Optional. The lock settings of the service."
               }
             },
             "enableTelemetry": {
@@ -1540,34 +1664,13 @@
             }
           },
           "variables": {
-            "copy": [
-              {
-                "name": "formattedAccessPolicies",
-                "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
-                "input": {
-                  "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
-                  "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
-                  "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
-                  "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
-                }
-              }
-            ],
             "builtInRoleNames": {
               "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
-              "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
-              "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]",
-              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
-              "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
-              "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
-              "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
-              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
-              "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
-              "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
               "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
               "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
             }
           },
           "resources": {
@@ -1575,7 +1678,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.6.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1591,95 +1694,36 @@
                 }
               }
             },
-            "keyVault": {
-              "type": "Microsoft.KeyVault/vaults",
-              "apiVersion": "2022-07-01",
+            "privateDnsZone": {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
               "name": "[parameters('name')]",
               "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
-                "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]",
-                "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
-                "enableSoftDelete": "[parameters('enableSoftDelete')]",
-                "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]",
-                "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]",
-                "createMode": "[parameters('createMode')]",
-                "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]",
-                "tenantId": "[subscription().tenantId]",
-                "accessPolicies": "[variables('formattedAccessPolicies')]",
-                "sku": {
-                  "name": "[parameters('sku')]",
-                  "family": "A"
-                },
-                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
-                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]"
-              }
-            },
-            "keyVault_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "tags": "[parameters('tags')]"
+            },
+            "privateDnsZone_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
               "properties": {
                 "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                 "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
               },
               "dependsOn": [
-                "keyVault"
-              ]
-            },
-            "keyVault_diagnosticSettings": {
-              "copy": {
-                "name": "keyVault_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "keyVault"
+                "privateDnsZone"
               ]
             },
-            "keyVault_roleAssignments": {
+            "privateDnsZone_roleAssignments": {
               "copy": {
-                "name": "keyVault_roleAssignments",
+                "name": "privateDnsZone_roleAssignments",
                 "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
               },
               "type": "Microsoft.Authorization/roleAssignments",
               "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
               "properties": {
                 "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                 "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
@@ -1690,25 +1734,40 @@
                 "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
               },
               "dependsOn": [
-                "keyVault"
+                "privateDnsZone"
               ]
             },
-            "keyVault_accessPolicies": {
-              "condition": "[not(empty(parameters('accessPolicies')))]",
+            "privateDnsZone_A": {
+              "copy": {
+                "name": "privateDnsZone_A",
+                "count": "[length(coalesce(parameters('a'), createArray()))]"
+              },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]",
+              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "keyVaultName": {
+                  "privateDnsZoneName": {
                     "value": "[parameters('name')]"
                   },
-                  "accessPolicies": {
-                    "value": "[parameters('accessPolicies')]"
+                  "name": {
+                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                  },
+                  "aRecords": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -1719,142 +1778,73 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.28.1.47646",
-                      "templateHash": "9363032158799379271"
+                      "templateHash": "8657463061873174631"
                     },
-                    "name": "Key Vault Access Policies",
-                    "description": "This module deploys a Key Vault Access Policy.",
+                    "name": "Private DNS Zone A record",
+                    "description": "This module deploys a Private DNS Zone A record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
-                    "accessPoliciesType": {
+                    "roleAssignmentType": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "properties": {
-                          "tenantId": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
                             "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                              "description": "Optional. The principal type of the assigned principal ID."
                             }
                           },
-                          "objectId": {
+                          "description": {
                             "type": "string",
+                            "nullable": true,
                             "metadata": {
-                              "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                              "description": "Optional. The description of the role assignment."
                             }
                           },
-                          "applicationId": {
+                          "condition": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Application ID of the client making request on behalf of a principal."
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                             }
                           },
-                          "permissions": {
-                            "type": "object",
-                            "properties": {
-                              "keys": {
-                                "type": "array",
-                                "allowedValues": [
-                                  "all",
-                                  "backup",
-                                  "create",
-                                  "decrypt",
-                                  "delete",
-                                  "encrypt",
-                                  "get",
-                                  "getrotationpolicy",
-                                  "import",
-                                  "list",
-                                  "purge",
-                                  "recover",
-                                  "release",
-                                  "restore",
-                                  "rotate",
-                                  "setrotationpolicy",
-                                  "sign",
-                                  "unwrapKey",
-                                  "update",
-                                  "verify",
-                                  "wrapKey"
-                                ],
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Permissions to keys."
-                                }
-                              },
-                              "secrets": {
-                                "type": "array",
-                                "allowedValues": [
-                                  "all",
-                                  "backup",
-                                  "delete",
-                                  "get",
-                                  "list",
-                                  "purge",
-                                  "recover",
-                                  "restore",
-                                  "set"
-                                ],
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Permissions to secrets."
-                                }
-                              },
-                              "certificates": {
-                                "type": "array",
-                                "allowedValues": [
-                                  "all",
-                                  "backup",
-                                  "create",
-                                  "delete",
-                                  "deleteissuers",
-                                  "get",
-                                  "getissuers",
-                                  "import",
-                                  "list",
-                                  "listissuers",
-                                  "managecontacts",
-                                  "manageissuers",
-                                  "purge",
-                                  "recover",
-                                  "restore",
-                                  "setissuers",
-                                  "update"
-                                ],
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Permissions to certificates."
-                                }
-                              },
-                              "storage": {
-                                "type": "array",
-                                "allowedValues": [
-                                  "all",
-                                  "backup",
-                                  "delete",
-                                  "deletesas",
-                                  "get",
-                                  "getsas",
-                                  "list",
-                                  "listsas",
-                                  "purge",
-                                  "recover",
-                                  "regeneratekey",
-                                  "restore",
-                                  "set",
-                                  "setsas",
-                                  "update"
-                                ],
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Permissions to storage accounts."
-                                }
-                              }
-                            },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
                             "metadata": {
-                              "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
@@ -1863,121 +1853,160 @@
                     }
                   },
                   "parameters": {
-                    "keyVaultName": {
+                    "privateDnsZoneName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "accessPolicies": {
-                      "$ref": "#/definitions/accessPoliciesType",
+                    "name": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID."
+                        "description": "Required. The name of the A record."
                       }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedAccessPolicies",
-                        "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
-                        "input": {
-                          "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
-                          "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
-                          "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
-                          "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
-                        }
+                    },
+                    "aRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of A records in the record set."
                       }
-                    ]
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
                   },
                   "resources": {
-                    "keyVault": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2022-07-01",
-                      "name": "[parameters('keyVaultName')]"
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "A": {
+                      "type": "Microsoft.Network/privateDnsZones/A",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "aRecords": "[parameters('aRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
                     },
-                    "policies": {
-                      "type": "Microsoft.KeyVault/vaults/accessPolicies",
-                      "apiVersion": "2022-07-01",
-                      "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]",
+                    "A_roleAssignments": {
+                      "copy": {
+                        "name": "A_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
-                        "accessPolicies": "[variables('formattedAccessPolicies')]"
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "keyVault"
+                        "A"
                       ]
                     }
                   },
                   "outputs": {
-                    "resourceGroupName": {
+                    "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the resource group the access policies assignment was created in."
+                        "description": "The name of the deployed A record."
                       },
-                      "value": "[resourceGroup().name]"
+                      "value": "[parameters('name')]"
                     },
-                    "name": {
+                    "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the access policies assignment."
+                        "description": "The resource ID of the deployed A record."
                       },
-                      "value": "add"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
-                    "resourceId": {
+                    "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the access policies assignment."
+                        "description": "The resource group of the deployed A record."
                       },
-                      "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]"
+                      "value": "[resourceGroup().name]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "keyVault"
+                "privateDnsZone"
               ]
             },
-            "keyVault_secrets": {
+            "privateDnsZone_AAAA": {
               "copy": {
-                "name": "keyVault_secrets",
-                "count": "[length(coalesce(parameters('secrets'), createArray()))]"
+                "name": "privateDnsZone_AAAA",
+                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
               },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]"
-                  },
-                  "value": {
-                    "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]"
-                  },
-                  "keyVaultName": {
+                  "privateDnsZoneName": {
                     "value": "[parameters('name')]"
                   },
-                  "attributesEnabled": {
-                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesEnabled')]"
-                  },
-                  "attributesExp": {
-                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesExp')]"
+                  "name": {
+                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
                   },
-                  "attributesNbf": {
-                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesNbf')]"
+                  "aaaaRecords": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
                   },
-                  "contentType": {
-                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]"
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
                   },
                   "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]"
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -1988,10 +2017,10 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.28.1.47646",
-                      "templateHash": "8081761451262814691"
+                      "templateHash": "1725749611610769138"
                     },
-                    "name": "Key Vault Secrets",
-                    "description": "This module deploys a Key Vault Secret.",
+                    "name": "Private DNS Zone AAAA record",
+                    "description": "This module deploys a Private DNS Zone AAAA record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
@@ -2063,57 +2092,37 @@
                     }
                   },
                   "parameters": {
-                    "keyVaultName": {
+                    "privateDnsZoneName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. The name of the secret."
+                        "description": "Required. The name of the AAAA record."
                       }
                     },
-                    "tags": {
-                      "type": "object",
+                    "aaaaRecords": {
+                      "type": "array",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Resource tags."
-                      }
-                    },
-                    "attributesEnabled": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Determines whether the object is enabled."
+                        "description": "Optional. The list of AAAA records in the record set."
                       }
                     },
-                    "attributesExp": {
-                      "type": "int",
+                    "metadata": {
+                      "type": "object",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "attributesNbf": {
+                    "ttl": {
                       "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
-                      }
-                    },
-                    "contentType": {
-                      "type": "securestring",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The content type of the secret."
-                      }
-                    },
-                    "value": {
-                      "type": "securestring",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
                     "roleAssignments": {
@@ -2126,11 +2135,8 @@
                   "variables": {
                     "builtInRoleNames": {
                       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
-                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
-                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
-                      "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
-                      "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
                       "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
                       "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
                       "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
@@ -2138,39 +2144,34 @@
                     }
                   },
                   "resources": {
-                    "keyVault": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2022-07-01",
-                      "name": "[parameters('keyVaultName')]"
-                    },
-                    "secret": {
-                      "type": "Microsoft.KeyVault/vaults/secrets",
-                      "apiVersion": "2022-07-01",
-                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "AAAA": {
+                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
                       "properties": {
-                        "contentType": "[parameters('contentType')]",
-                        "attributes": {
-                          "enabled": "[parameters('attributesEnabled')]",
-                          "exp": "[parameters('attributesExp')]",
-                          "nbf": "[parameters('attributesNbf')]"
-                        },
-                        "value": "[parameters('value')]"
+                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
                       },
                       "dependsOn": [
-                        "keyVault"
+                        "privateDnsZone"
                       ]
                     },
-                    "secret_roleAssignments": {
+                    "AAAA_roleAssignments": {
                       "copy": {
-                        "name": "secret_roleAssignments",
+                        "name": "AAAA_roleAssignments",
                         "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
                       "type": "Microsoft.Authorization/roleAssignments",
                       "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]",
-                      "name": "[guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
                         "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                         "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
@@ -2181,7 +2182,7 @@
                         "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "secret"
+                        "AAAA"
                       ]
                     }
                   },
@@ -2189,21 +2190,21 @@
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the secret."
+                        "description": "The name of the deployed AAAA record."
                       },
                       "value": "[parameters('name')]"
                     },
                     "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the secret."
+                        "description": "The resource ID of the deployed AAAA record."
                       },
-                      "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
                     "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the resource group the secret was created in."
+                        "description": "The resource group of the deployed AAAA record."
                       },
                       "value": "[resourceGroup().name]"
                     }
@@ -2211,57 +2212,40 @@
                 }
               },
               "dependsOn": [
-                "keyVault"
+                "privateDnsZone"
               ]
             },
-            "keyVault_keys": {
+            "privateDnsZone_CNAME": {
               "copy": {
-                "name": "keyVault_keys",
-                "count": "[length(coalesce(parameters('keys'), createArray()))]"
+                "name": "privateDnsZone_CNAME",
+                "count": "[length(coalesce(parameters('cname'), createArray()))]"
               },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]"
-                  },
-                  "keyVaultName": {
+                  "privateDnsZoneName": {
                     "value": "[parameters('name')]"
                   },
-                  "attributesEnabled": {
-                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesEnabled')]"
-                  },
-                  "attributesExp": {
-                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesExp')]"
-                  },
-                  "attributesNbf": {
-                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesNbf')]"
-                  },
-                  "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]",
-                  "keyOps": {
-                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]"
+                  "name": {
+                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
                   },
-                  "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]",
-                  "releasePolicy": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]"
+                  "cnameRecord": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
                   },
-                  "kty": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]"
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
                   },
                   "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "rotationPolicy": {
-                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]"
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -2272,10 +2256,10 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.28.1.47646",
-                      "templateHash": "6463446681908714455"
+                      "templateHash": "12750497126800708872"
                     },
-                    "name": "Key Vault Keys",
-                    "description": "This module deploys a Key Vault Key.",
+                    "name": "Private DNS Zone CNAME record",
+                    "description": "This module deploys a Private DNS Zone CNAME record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
@@ -2347,125 +2331,51 @@
                     }
                   },
                   "parameters": {
-                    "keyVaultName": {
+                    "privateDnsZoneName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. The name of the key."
+                        "description": "Required. The name of the CNAME record."
                       }
                     },
-                    "tags": {
+                    "cnameRecord": {
                       "type": "object",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Resource tags."
-                      }
-                    },
-                    "attributesEnabled": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Determines whether the object is enabled."
+                        "description": "Optional. A CNAME record."
                       }
                     },
-                    "attributesExp": {
-                      "type": "int",
+                    "metadata": {
+                      "type": "object",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "attributesNbf": {
+                    "ttl": {
                       "type": "int",
-                      "nullable": true,
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
-                    "curveName": {
-                      "type": "string",
-                      "defaultValue": "P-256",
-                      "allowedValues": [
-                        "P-256",
-                        "P-256K",
-                        "P-384",
-                        "P-521"
-                      ],
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
                       "metadata": {
-                        "description": "Optional. The elliptic curve name."
-                      }
-                    },
-                    "keyOps": {
-                      "type": "array",
-                      "nullable": true,
-                      "allowedValues": [
-                        "decrypt",
-                        "encrypt",
-                        "import",
-                        "sign",
-                        "unwrapKey",
-                        "verify",
-                        "wrapKey"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Array of JsonWebKeyOperation."
-                      }
-                    },
-                    "keySize": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA."
-                      }
-                    },
-                    "kty": {
-                      "type": "string",
-                      "defaultValue": "EC",
-                      "allowedValues": [
-                        "EC",
-                        "EC-HSM",
-                        "RSA",
-                        "RSA-HSM"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The type of the key."
-                      }
-                    },
-                    "releasePolicy": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Key release policy."
-                      }
-                    },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "rotationPolicy": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Key rotation policy properties object."
+                        "description": "Optional. Array of role assignments to create."
                       }
                     }
                   },
                   "variables": {
                     "builtInRoleNames": {
                       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
-                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
-                      "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
-                      "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
-                      "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
-                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
                       "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
                       "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
                       "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
@@ -2473,43 +2383,34 @@
                     }
                   },
                   "resources": {
-                    "keyVault": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2022-07-01",
-                      "name": "[parameters('keyVaultName')]"
-                    },
-                    "key": {
-                      "type": "Microsoft.KeyVault/vaults/keys",
-                      "apiVersion": "2022-07-01",
-                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
-                      "tags": "[parameters('tags')]",
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "CNAME": {
+                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
                       "properties": {
-                        "attributes": {
-                          "enabled": "[parameters('attributesEnabled')]",
-                          "exp": "[parameters('attributesExp')]",
-                          "nbf": "[parameters('attributesNbf')]"
-                        },
-                        "curveName": "[parameters('curveName')]",
-                        "keyOps": "[parameters('keyOps')]",
-                        "keySize": "[parameters('keySize')]",
-                        "kty": "[parameters('kty')]",
-                        "rotationPolicy": "[coalesce(parameters('rotationPolicy'), createObject())]",
-                        "release_policy": "[coalesce(parameters('releasePolicy'), createObject())]"
+                        "cnameRecord": "[parameters('cnameRecord')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
                       },
                       "dependsOn": [
-                        "keyVault"
+                        "privateDnsZone"
                       ]
                     },
-                    "key_roleAssignments": {
+                    "CNAME_roleAssignments": {
                       "copy": {
-                        "name": "key_roleAssignments",
+                        "name": "CNAME_roleAssignments",
                         "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
                       "type": "Microsoft.Authorization/roleAssignments",
                       "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]",
-                      "name": "[guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
                         "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                         "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
@@ -2520,7 +2421,7 @@
                         "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "key"
+                        "CNAME"
                       ]
                     }
                   },
@@ -2528,21 +2429,21 @@
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the key."
+                        "description": "The name of the deployed CNAME record."
                       },
                       "value": "[parameters('name')]"
                     },
                     "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the key."
+                        "description": "The resource ID of the deployed CNAME record."
                       },
-                      "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
                     "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the resource group the key was created in."
+                        "description": "The resource group of the deployed CNAME record."
                       },
                       "value": "[resourceGroup().name]"
                     }
@@ -2550,64 +2451,40 @@
                 }
               },
               "dependsOn": [
-                "keyVault"
+                "privateDnsZone"
               ]
             },
-            "keyVault_privateEndpoints": {
+            "privateDnsZone_MX": {
               "copy": {
-                "name": "keyVault_privateEndpoints",
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                "name": "privateDnsZone_MX",
+                "count": "[length(coalesce(parameters('mx'), createArray()))]"
               },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]"
-                  },
-                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]",
-                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                  "subnetResourceId": {
-                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
                   },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  "name": {
+                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
                   },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "privateDnsZoneGroupName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                  "mxRecords": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
                   },
-                  "privateDnsZoneResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
                   },
                   "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "customDnsConfigs": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                  },
-                  "ipConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                  },
-                  "customNetworkInterfaceName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -2617,11 +2494,11 @@
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "4120048060064073955"
+                      "version": "0.28.1.47646",
+                      "templateHash": "13512848802819943036"
                     },
-                    "name": "Private Endpoints",
-                    "description": "This module deploys a Private Endpoint.",
+                    "name": "Private DNS Zone MX record",
+                    "description": "This module deploys a Private DNS Zone MX record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
@@ -2690,174 +2567,240 @@
                         }
                       },
                       "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
                     },
-                    "lockType": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the MX record."
+                      }
+                    },
+                    "metadata": {
                       "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "nullable": true
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
                     },
-                    "ipConfigurationsType": {
+                    "mxRecords": {
                       "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the resource that is unique within a resource group."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "memberName": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateIPAddress": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private endpoint IP configurations."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of MX records in the record set."
+                      }
                     },
-                    "manualPrivateLinkServiceConnectionsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the private link service connection."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupIds": {
-                                "type": "array",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateLinkServiceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of private link service."
-                                }
-                              },
-                              "requestMessage": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private link service connection."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
                     },
-                    "privateLinkServiceConnectionsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "MX": {
+                      "type": "Microsoft.Network/privateDnsZones/MX",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "mxRecords": "[parameters('mxRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "MX_roleAssignments": {
+                      "copy": {
+                        "name": "MX_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "MX"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed MX record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed MX record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed MX record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_PTR": {
+              "copy": {
+                "name": "privateDnsZone_PTR",
+                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ptrRecords": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "5069219418696231980"
+                    },
+                    "name": "Private DNS Zone PTR record",
+                    "description": "This module deploys a Private DNS Zone PTR record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
                         "properties": {
-                          "name": {
+                          "roleDefinitionIdOrName": {
                             "type": "string",
                             "metadata": {
-                              "description": "Required. The name of the private link service connection."
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                             }
                           },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupIds": {
-                                "type": "array",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateLinkServiceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of private link service."
-                                }
-                              },
-                              "requestMessage": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                }
-                              }
-                            },
+                          "principalId": {
+                            "type": "string",
                             "metadata": {
-                              "description": "Required. Properties of private link service connection."
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                             }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "customDnsConfigType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "fqdn": {
+                          },
+                          "principalType": {
                             "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
                             "metadata": {
-                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                              "description": "Optional. The principal type of the assigned principal ID."
                             }
                           },
-                          "ipAddresses": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
                             "metadata": {
-                              "description": "Required. A list of private IP addresses of the private endpoint."
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
@@ -2866,63 +2809,37 @@
                     }
                   },
                   "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the private endpoint resource to create."
-                      }
-                    },
-                    "subnetResourceId": {
+                    "privateDnsZoneName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                      }
-                    },
-                    "applicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "customNetworkInterfaceName": {
+                    "name": {
                       "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                      }
-                    },
-                    "ipConfigurations": {
-                      "$ref": "#/definitions/ipConfigurationsType",
                       "metadata": {
-                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                        "description": "Required. The name of the PTR record."
                       }
                     },
-                    "privateDnsZoneGroupName": {
-                      "type": "string",
+                    "metadata": {
+                      "type": "object",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "privateDnsZoneResourceIds": {
+                    "ptrRecords": {
                       "type": "array",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
+                        "description": "Optional. The list of PTR records in the record set."
                       }
                     },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. The lock settings of the service."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
                     "roleAssignments": {
@@ -2930,124 +2847,287 @@
                       "metadata": {
                         "description": "Optional. Array of role assignments to create."
                       }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "PTR": {
+                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ptrRecords": "[parameters('ptrRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
                     },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
+                    "PTR_roleAssignments": {
+                      "copy": {
+                        "name": "PTR_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "PTR"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                        "description": "The name of the deployed PTR record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed PTR record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed PTR record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SOA": {
+              "copy": {
+                "name": "privateDnsZone_SOA",
+                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "soaRecord": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "8649693365938652763"
+                    },
+                    "name": "Private DNS Zone SOA record",
+                    "description": "This module deploys a Private DNS Zone SOA record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "customDnsConfigs": {
-                      "$ref": "#/definitions/customDnsConfigType",
+                    "name": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. Custom DNS configurations."
+                        "description": "Required. The name of the SOA record."
                       }
                     },
-                    "manualPrivateLinkServiceConnections": {
-                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "privateLinkServiceConnections": {
-                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                    "soaRecord": {
+                      "type": "object",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                        "description": "Optional. A SOA record."
                       }
                     },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
                       }
                     }
                   },
                   "variables": {
                     "builtInRoleNames": {
                       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
                       "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
                       "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
                       "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
                     }
                   },
                   "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2023-07-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "privateEndpoint": {
-                      "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "applicationSecurityGroups",
-                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                            "input": {
-                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                            }
-                          }
-                        ],
-                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                        "subnet": {
-                          "id": "[parameters('subnetResourceId')]"
-                        }
-                      }
-                    },
-                    "privateEndpoint_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SOA": {
+                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
                       "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                        "metadata": "[parameters('metadata')]",
+                        "soaRecord": "[parameters('soaRecord')]",
+                        "ttl": "[parameters('ttl')]"
                       },
                       "dependsOn": [
-                        "privateEndpoint"
+                        "privateDnsZone"
                       ]
                     },
-                    "privateEndpoint_roleAssignments": {
+                    "SOA_roleAssignments": {
                       "copy": {
-                        "name": "privateEndpoint_roleAssignments",
+                        "name": "SOA_roleAssignments",
                         "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
                       "type": "Microsoft.Authorization/roleAssignments",
                       "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
                         "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                         "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
@@ -3058,1032 +3138,1406 @@
                         "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "privateEndpoint"
+                        "SOA"
                       ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SOA record."
+                      },
+                      "value": "[parameters('name')]"
                     },
-                    "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SOA record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SOA record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SRV": {
+              "copy": {
+                "name": "privateDnsZone_SRV",
+                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "srvRecords": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "1580431299497536987"
+                    },
+                    "name": "Private DNS Zone SRV record",
+                    "description": "This module deploys a Private DNS Zone SRV record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
                           },
-                          "privateDNSResourceIds": {
-                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
                           },
-                          "privateEndpointName": {
-                            "value": "[parameters('name')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.25.53.49325",
-                              "templateHash": "11244630631275470040"
-                            },
-                            "name": "Private Endpoint Private DNS Zone Groups",
-                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
-                            "owner": "Azure/module-maintainers"
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
                           },
-                          "parameters": {
-                            "privateEndpointName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "privateDNSResourceIds": {
-                              "type": "array",
-                              "minLength": 1,
-                              "maxLength": 5,
-                              "metadata": {
-                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the private DNS zone group."
-                              }
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
                             }
                           },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneConfigs",
-                                "count": "[length(parameters('privateDNSResourceIds'))]",
-                                "input": {
-                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
-                                  "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
-                                  }
-                                }
-                              }
-                            ]
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
                           },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                              "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                              }
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
                             }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint DNS zone group."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint DNS zone group."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint DNS zone group was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
                       },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
+                      "nullable": true
                     }
                   },
-                  "outputs": {
-                    "resourceGroupName": {
+                  "parameters": {
+                    "privateDnsZoneName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group the private endpoint was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
                     },
-                    "resourceId": {
+                    "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the private endpoint."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                        "description": "Required. The name of the SRV record."
+                      }
                     },
-                    "name": {
-                      "type": "string",
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
                       "metadata": {
-                        "description": "The name of the private endpoint."
-                      },
-                      "value": "[parameters('name')]"
+                        "description": "Optional. The metadata attached to the record set."
+                      }
                     },
-                    "location": {
-                      "type": "string",
+                    "srvRecords": {
+                      "type": "array",
+                      "nullable": true,
                       "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                        "description": "Optional. The list of SRV records in the record set."
+                      }
                     },
-                    "groupId": {
-                      "type": "string",
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "The group Id for the private endpoint Group."
-                      },
-                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
                     }
-                  }
-                }
-              },
-              "dependsOn": [
-                "keyVault"
-              ]
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the key vault."
-              },
-              "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the resource group the key vault was created in."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the key vault."
-              },
-              "value": "[parameters('name')]"
-            },
-            "uri": {
-              "type": "string",
-              "metadata": {
-                "description": "The URI of the key vault."
-              },
-              "value": "[reference('keyVault').vaultUri]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('keyVault', '2022-07-01', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalyticsWorkspace",
-        "managedIdentity"
-      ]
-    },
-    "storageAccount": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[format('{0}-storage', uniqueString(deployment().name, parameters('location')))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[coalesce(tryGet(parameters('storageAccountSettings'), 'name'), format('st{0}', parameters('name')))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "skuName": {
-            "value": "[coalesce(tryGet(parameters('storageAccountSettings'), 'sku'), 'Standard_RAGZRS')]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "allowBlobPublicAccess": {
-            "value": false
-          },
-          "allowSharedKeyAccess": {
-            "value": "[coalesce(tryGet(parameters('storageAccountSettings'), 'allowSharedKeyAccess'), false())]"
-          },
-          "defaultToOAuthAuthentication": {
-            "value": "[not(coalesce(tryGet(parameters('storageAccountSettings'), 'allowSharedKeyAccess'), false()))]"
-          },
-          "publicNetworkAccess": {
-            "value": "Disabled"
-          },
-          "networkAcls": {
-            "value": {
-              "defaultAction": "Deny",
-              "bypass": "AzureServices"
-            }
-          },
-          "roleAssignments": {
-            "value": [
-              {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Contributor"
-              },
-              {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Storage Blob Data Contributor"
-              },
-              {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "69566ab7-960f-475b-8e7c-b3118f30c6bd"
-              }
-            ]
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "7296091181254270609"
-            },
-            "name": "Storage Accounts",
-            "description": "This module deploys a Storage Account.",
-            "owner": "Azure/module-maintainers"
-          },
-          "definitions": {
-            "managedIdentitiesType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SRV": {
+                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "srvRecords": "[parameters('srvRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "SRV_roleAssignments": {
+                      "copy": {
+                        "name": "SRV_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "SRV"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SRV record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SRV record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SRV record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
                   }
                 }
               },
-              "nullable": true
+              "dependsOn": [
+                "privateDnsZone"
+              ]
             },
-            "lockType": {
-              "type": "object",
+            "privateDnsZone_TXT": {
+              "copy": {
+                "name": "privateDnsZone_TXT",
+                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
                 },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "roleAssignmentType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "roleDefinitionIdOrName": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                    }
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
                   },
-                  "principalId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                    }
+                  "name": {
+                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
                   },
-                  "principalType": {
-                    "type": "string",
-                    "allowedValues": [
-                      "Device",
-                      "ForeignGroup",
-                      "Group",
-                      "ServicePrincipal",
-                      "User"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The principal type of the assigned principal ID."
-                    }
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "description": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The description of the role assignment."
-                    }
+                  "txtRecords": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
                   },
-                  "condition": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                    }
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
                   },
-                  "conditionVersion": {
-                    "type": "string",
-                    "allowedValues": [
-                      "2.0"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Version of the condition."
-                    }
-                  },
-                  "delegatedManagedIdentityResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "networkAclsType": {
-              "type": "object",
-              "properties": {
-                "resourceAccessRules": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "tenantId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The ID of the tenant in which the resource resides in."
-                        }
-                      },
-                      "resourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
-                  }
-                },
-                "bypass": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureServices",
-                    "AzureServices, Logging",
-                    "AzureServices, Logging, Metrics",
-                    "AzureServices, Metrics",
-                    "Logging",
-                    "Logging, Metrics",
-                    "Metrics",
-                    "None"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
-                  }
-                },
-                "virtualNetworkRules": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Sets the virtual network rules."
-                  }
-                },
-                "ipRules": {
-                  "type": "array",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Sets the IP ACL rules."
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
-                "defaultAction": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Allow",
-                    "Deny"
-                  ],
-                  "nullable": true,
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
                   "metadata": {
-                    "description": "Optional. Specifies the default action of allow or deny when no other rules match."
-                  }
-                }
-              }
-            },
-            "privateEndpointType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private endpoint."
-                    }
-                  },
-                  "location": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The location to deploy the private endpoint to."
-                    }
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "1628766837655887758"
+                    },
+                    "name": "Private DNS Zone TXT record",
+                    "description": "This module deploys a Private DNS Zone TXT record.",
+                    "owner": "Azure/module-maintainers"
                   },
-                  "privateLinkServiceConnectionName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private link connection to create."
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
                     }
                   },
-                  "service": {
-                    "type": "string",
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the TXT record."
+                      }
+                    },
                     "metadata": {
-                      "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\"."
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "txtRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of TXT records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
                     }
                   },
-                  "subnetResourceId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
                     }
                   },
-                  "privateDnsZoneGroupName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided."
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "TXT": {
+                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]",
+                        "txtRecords": "[parameters('txtRecords')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "TXT_roleAssignments": {
+                      "copy": {
+                        "name": "TXT_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "TXT"
+                      ]
                     }
                   },
-                  "privateDnsZoneResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed TXT record."
+                      },
+                      "value": "[parameters('name')]"
                     },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed TXT record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed TXT record."
+                      },
+                      "value": "[resourceGroup().name]"
                     }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_virtualNetworkLinks": {
+              "copy": {
+                "name": "privateDnsZone_virtualNetworkLinks",
+                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
                   },
-                  "isManualConnection": {
-                    "type": "bool",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. If Manual Private Link Connection is required."
-                    }
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
                   },
-                  "manualConnectionRequestMessage": {
-                    "type": "string",
-                    "nullable": true,
-                    "maxLength": 140,
-                    "metadata": {
-                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                    }
+                  "virtualNetworkResourceId": {
+                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
                   },
-                  "customDnsConfigs": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Required. Fqdn that resolves to private endpoint ip address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private ip addresses of the private endpoint."
-                          }
-                        }
-                      }
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                  },
+                  "registrationEnabled": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "8423159394395901832"
                     },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Custom DNS configurations."
-                    }
+                    "name": "Private DNS Zone Virtual Network Link",
+                    "description": "This module deploys a Private DNS Zone Virtual Network Link.",
+                    "owner": "Azure/module-maintainers"
                   },
-                  "ipConfigurations": {
-                    "type": "array",
-                    "items": {
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The name of the virtual network link."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "global",
+                      "metadata": {
+                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                      }
+                    },
+                    "tags": {
                       "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private ip address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
                       }
                     },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                    }
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
+                    "registrationEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                      }
                     },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                    }
-                  },
-                  "customNetworkInterfaceName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                    }
-                  },
-                  "lock": {
-                    "$ref": "#/definitions/lockType",
-                    "metadata": {
-                      "description": "Optional. Specify the type of lock."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
-                    }
-                  },
-                  "tags": {
-                    "type": "object",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                    "virtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Link to another virtual network resource ID."
+                      }
                     }
                   },
-                  "enableTelemetry": {
-                    "type": "bool",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Enable/Disable usage telemetry for module."
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "virtualNetworkLink": {
+                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                        "virtualNetwork": {
+                          "id": "[parameters('virtualNetworkResourceId')]"
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
                     }
                   },
-                  "resourceGroupName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed virtual network link."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed virtual network link."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed virtual network link."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('virtualNetworkLink', '2020-06-01', 'full').location]"
                     }
                   }
                 }
               },
-              "nullable": true
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the private DNS zone was deployed into."
+              },
+              "value": "[resourceGroup().name]"
             },
-            "diagnosticSettingType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of diagnostic setting."
-                    }
-                  },
-                  "metricCategories": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "category": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                          }
-                        },
-                        "enabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the private DNS zone."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the private DNS zone."
+              },
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork"
+      ]
+    },
+    "workspaceHub_privateDnsZones": {
+      "copy": {
+        "name": "workspaceHub_privateDnsZones",
+        "count": "[length(objectKeys(variables('mlPrivateDnsZones')))]"
+      },
+      "condition": "[variables('createVirtualNetwork')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-workspace-private-dns-zones', uniqueString(deployment().name, parameters('location'), objectKeys(variables('mlPrivateDnsZones'))[copyIndex()]))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[objectKeys(variables('mlPrivateDnsZones'))[copyIndex()]]"
+          },
+          "virtualNetworkLinks": {
+            "value": [
+              {
+                "virtualNetworkResourceId": "[resourceId('Microsoft.Network/virtualNetworks', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))))]"
+              }
+            ]
+          },
+          "roleAssignments": {
+            "value": [
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "13567552508326841182"
+            },
+            "name": "Private DNS Zones",
+            "description": "This module deploys a Private DNS zone.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
                     "metadata": {
-                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                     }
                   },
-                  "logAnalyticsDestinationType": {
+                  "principalId": {
                     "type": "string",
-                    "allowedValues": [
-                      "AzureDiagnostics",
-                      "Dedicated"
-                    ],
-                    "nullable": true,
                     "metadata": {
-                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                     }
                   },
-                  "workspaceResourceId": {
+                  "principalType": {
                     "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                      "description": "Optional. The principal type of the assigned principal ID."
                     }
                   },
-                  "storageAccountResourceId": {
+                  "description": {
                     "type": "string",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                      "description": "Optional. The description of the role assignment."
                     }
                   },
-                  "eventHubAuthorizationRuleResourceId": {
+                  "condition": {
                     "type": "string",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                     }
                   },
-                  "eventHubName": {
+                  "conditionVersion": {
                     "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                      "description": "Optional. Version of the condition."
                     }
                   },
-                  "marketplacePartnerResourceId": {
+                  "delegatedManagedIdentityResourceId": {
                     "type": "string",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
                     }
                   }
                 }
               },
               "nullable": true
             },
-            "customerManagedKeyType": {
+            "lockType": {
               "type": "object",
               "properties": {
-                "keyVaultResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                  }
-                },
-                "keyName": {
+                "name": {
                   "type": "string",
+                  "nullable": true,
                   "metadata": {
-                    "description": "Required. The name of the customer managed key to use for encryption."
+                    "description": "Optional. Specify the name of lock."
                   }
                 },
-                "keyVersion": {
+                "kind": {
                   "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
                   "nullable": true,
                   "metadata": {
-                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
+                    "description": "Optional. Specify the type of lock."
                   }
-                },
-                "userAssignedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
+                }
+              },
+              "nullable": true
+            },
+            "aType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
                   "metadata": {
-                    "description": "Optional. User assigned identity to use when fetching the customer managed key. If used must also be specified in `managedIdentities.userAssignedResourceIds`. Required if no system assigned identity is available for use."
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "aRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ipv4Address": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IPv4 address of this A record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of A records in the record set."
+                    }
                   }
                 }
               },
               "nullable": true
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "maxLength": 24,
-              "metadata": {
-                "description": "Required. Name of the Storage Account. Must be lower-case."
-              }
             },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all resources."
-              }
+            "aaaaType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "aaaaRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ipv6Address": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IPv6 address of this AAAA record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of AAAA records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
             },
-            "roleAssignments": {
-              "$ref": "#/definitions/roleAssignmentType",
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentitiesType",
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "defaultValue": "StorageV2",
-              "allowedValues": [
-                "Storage",
-                "StorageV2",
-                "BlobStorage",
-                "FileStorage",
-                "BlockBlobStorage"
-              ],
-              "metadata": {
-                "description": "Optional. Type of Storage Account to create."
-              }
-            },
-            "skuName": {
-              "type": "string",
-              "defaultValue": "Standard_GRS",
-              "allowedValues": [
-                "Standard_LRS",
-                "Standard_GRS",
-                "Standard_RAGRS",
-                "Standard_ZRS",
-                "Premium_LRS",
-                "Premium_ZRS",
-                "Standard_GZRS",
-                "Standard_RAGZRS"
-              ],
-              "metadata": {
-                "description": "Optional. Storage Account Sku Name."
-              }
-            },
-            "accessTier": {
-              "type": "string",
-              "defaultValue": "Hot",
-              "allowedValues": [
-                "Premium",
-                "Hot",
-                "Cool"
-              ],
-              "metadata": {
-                "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
-              }
-            },
-            "largeFileSharesState": {
-              "type": "string",
-              "defaultValue": "Disabled",
-              "allowedValues": [
-                "Disabled",
-                "Enabled"
-              ],
-              "metadata": {
-                "description": "Optional. Allow large file shares if sets to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
-              }
-            },
-            "azureFilesIdentityBasedAuthentication": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. Provides the identity based authentication settings for Azure Files."
-              }
-            },
-            "defaultToOAuthAuthentication": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
-              }
-            },
-            "allowSharedKeyAccess": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
-              }
-            },
-            "privateEndpoints": {
-              "$ref": "#/definitions/privateEndpointType",
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-              }
-            },
-            "managementPolicyRules": {
+            "cnameType": {
               "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The Storage Account ManagementPolicies Rules."
-              }
-            },
-            "networkAcls": {
-              "$ref": "#/definitions/networkAclsType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
-              }
-            },
-            "requireInfrastructureEncryption": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
-              }
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "cnameRecord": {
+                    "type": "object",
+                    "properties": {
+                      "cname": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The canonical name of the CNAME record."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The CNAME record in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
             },
-            "allowCrossTenantReplication": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Allow or disallow cross AAD tenant object replication."
-              }
+            "mxType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "mxRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "exchange": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name of the mail host for this MX record."
+                          }
+                        },
+                        "preference": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The preference value for this MX record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of MX records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
             },
-            "customDomainName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
-              }
+            "ptrType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "ptrRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ptrdname": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The PTR target domain name for this PTR record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of PTR records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
             },
-            "customDomainUseSubDomainName": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
-              }
+            "soaType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "soaRecord": {
+                    "type": "object",
+                    "properties": {
+                      "email": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The email contact for this SOA record."
+                        }
+                      },
+                      "expireTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The expire time for this SOA record."
+                        }
+                      },
+                      "host": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The domain name of the authoritative name server for this SOA record."
+                        }
+                      },
+                      "minimumTtl": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The minimum value for this SOA record. By convention this is used to determine the negative caching duration."
+                        }
+                      },
+                      "refreshTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The refresh value for this SOA record."
+                        }
+                      },
+                      "retryTime": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The retry time for this SOA record."
+                        }
+                      },
+                      "serialNumber": {
+                        "type": "int",
+                        "metadata": {
+                          "description": "Required. The serial number for this SOA record."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The SOA record in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
             },
-            "dnsEndpointType": {
+            "srvType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "srvRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "priority": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The priority value for this SRV record."
+                          }
+                        },
+                        "weight": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The weight value for this SRV record."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The port value for this SRV record."
+                          }
+                        },
+                        "target": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The target domain name for this SRV record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of SRV records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "txtType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the record."
+                    }
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The metadata of the record."
+                    }
+                  },
+                  "ttl": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The TTL of the record."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "txtRecords": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "value": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The text value of this TXT record."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The list of TXT records in the record set."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
               "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "",
-                "AzureDnsZone",
-                "Standard"
-              ],
               "metadata": {
-                "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
+                "description": "Required. Private DNS zone name."
               }
             },
-            "blobServices": {
-              "type": "object",
-              "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
+            "a": {
+              "$ref": "#/definitions/aType",
               "metadata": {
-                "description": "Optional. Blob service and containers to deploy."
+                "description": "Optional. Array of A records."
               }
             },
-            "fileServices": {
-              "type": "object",
-              "defaultValue": {},
+            "aaaa": {
+              "$ref": "#/definitions/aaaaType",
               "metadata": {
-                "description": "Optional. File service and shares to deploy."
+                "description": "Optional. Array of AAAA records."
               }
             },
-            "queueServices": {
-              "type": "object",
-              "defaultValue": {},
+            "cname": {
+              "$ref": "#/definitions/cnameType",
               "metadata": {
-                "description": "Optional. Queue service and queues to create."
+                "description": "Optional. Array of CNAME records."
               }
             },
-            "tableServices": {
-              "type": "object",
-              "defaultValue": {},
+            "mx": {
+              "$ref": "#/definitions/mxType",
               "metadata": {
-                "description": "Optional. Table service and tables to create."
+                "description": "Optional. Array of MX records."
               }
             },
-            "allowBlobPublicAccess": {
-              "type": "bool",
-              "defaultValue": false,
+            "ptr": {
+              "$ref": "#/definitions/ptrType",
               "metadata": {
-                "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
+                "description": "Optional. Array of PTR records."
               }
             },
-            "minimumTlsVersion": {
-              "type": "string",
-              "defaultValue": "TLS1_2",
-              "allowedValues": [
-                "TLS1_0",
-                "TLS1_1",
-                "TLS1_2"
-              ],
+            "soa": {
+              "$ref": "#/definitions/soaType",
               "metadata": {
-                "description": "Optional. Set the minimum TLS version on request to storage."
+                "description": "Optional. Array of SOA records."
               }
             },
-            "enableHierarchicalNamespace": {
-              "type": "bool",
-              "defaultValue": false,
+            "srv": {
+              "$ref": "#/definitions/srvType",
               "metadata": {
-                "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
+                "description": "Optional. Array of SRV records."
               }
             },
-            "enableSftp": {
-              "type": "bool",
-              "defaultValue": false,
+            "txt": {
+              "$ref": "#/definitions/txtType",
               "metadata": {
-                "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
+                "description": "Optional. Array of TXT records."
               }
             },
-            "localUsers": {
+            "virtualNetworkLinks": {
               "type": "array",
-              "defaultValue": [],
+              "nullable": true,
               "metadata": {
-                "description": "Optional. Local users to deploy for SFTP authentication."
+                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
               }
             },
-            "isLocalUserEnabled": {
-              "type": "bool",
-              "defaultValue": false,
+            "location": {
+              "type": "string",
+              "defaultValue": "global",
               "metadata": {
-                "description": "Optional. Enables local users feature, if set to true."
+                "description": "Optional. The location of the PrivateDNSZone. Should be global."
               }
             },
-            "enableNfsV3": {
-              "type": "bool",
-              "defaultValue": false,
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
               "metadata": {
-                "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
+                "description": "Optional. Array of role assignments to create."
               }
             },
-            "diagnosticSettings": {
-              "$ref": "#/definitions/diagnosticSettingType",
+            "tags": {
+              "type": "object",
+              "nullable": true,
               "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
+                "description": "Optional. Tags of the resource."
               }
             },
             "lock": {
@@ -4092,124 +4546,30 @@
                 "description": "Optional. The lock settings of the service."
               }
             },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
             "enableTelemetry": {
               "type": "bool",
               "defaultValue": true,
               "metadata": {
                 "description": "Optional. Enable/Disable usage telemetry for module."
               }
-            },
-            "allowedCopyScope": {
-              "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "",
-                "AAD",
-                "PrivateLink"
-              ],
-              "metadata": {
-                "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "defaultValue": "",
-              "allowedValues": [
-                "",
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-              }
-            },
-            "supportsHttpsTrafficOnly": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
-              }
-            },
-            "customerManagedKey": {
-              "$ref": "#/definitions/customerManagedKeyType",
-              "metadata": {
-                "description": "Optional. The customer managed key definition."
-              }
-            },
-            "sasExpirationPeriod": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
-              }
-            },
-            "keyType": {
-              "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Account",
-                "Service"
-              ],
-              "metadata": {
-                "description": "Optional. The keyType to use with Queue & Table services."
-              }
             }
           },
           "variables": {
-            "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
-            "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
             "builtInRoleNames": {
               "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
               "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
               "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-              "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-              "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-              "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
-              "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
-              "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
-              "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
-              "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
-              "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-              "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
-              "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
-              "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
-              "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
-              "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
             }
           },
           "resources": {
-            "cMKKeyVault::cMKKey": {
-              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults/keys",
-              "apiVersion": "2023-02-01",
-              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
-              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
-              "dependsOn": [
-                "cMKKeyVault"
-              ]
-            },
             "avmTelemetry": {
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -4225,120 +4585,36 @@
                 }
               }
             },
-            "cMKKeyVault": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults",
-              "apiVersion": "2023-02-01",
-              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
-              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
-            },
-            "cMKUserAssignedIdentity": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-              "apiVersion": "2023-01-31",
-              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
-              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
-            },
-            "storageAccount": {
-              "type": "Microsoft.Storage/storageAccounts",
-              "apiVersion": "2022-09-01",
+            "privateDnsZone": {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2020-06-01",
               "name": "[parameters('name')]",
               "location": "[parameters('location')]",
-              "kind": "[parameters('kind')]",
-              "sku": {
-                "name": "[parameters('skuName')]"
-              },
-              "identity": "[variables('identity')]",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "allowSharedKeyAccess": "[parameters('allowSharedKeyAccess')]",
-                "defaultToOAuthAuthentication": "[parameters('defaultToOAuthAuthentication')]",
-                "allowCrossTenantReplication": "[parameters('allowCrossTenantReplication')]",
-                "allowedCopyScope": "[if(not(empty(parameters('allowedCopyScope'))), parameters('allowedCopyScope'), null())]",
-                "customDomain": {
-                  "name": "[parameters('customDomainName')]",
-                  "useSubDomainName": "[parameters('customDomainUseSubDomainName')]"
-                },
-                "dnsEndpointType": "[if(not(empty(parameters('dnsEndpointType'))), parameters('dnsEndpointType'), null())]",
-                "isLocalUserEnabled": "[parameters('isLocalUserEnabled')]",
-                "encryption": "[union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), parameters('customerManagedKey').keyVersion, last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/')))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2], split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject()))]",
-                "accessTier": "[if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null())]",
-                "sasPolicy": "[if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', 'Log', 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null())]",
-                "supportsHttpsTrafficOnly": "[parameters('supportsHttpsTrafficOnly')]",
-                "isHnsEnabled": "[if(parameters('enableHierarchicalNamespace'), parameters('enableHierarchicalNamespace'), null())]",
-                "isSftpEnabled": "[parameters('enableSftp')]",
-                "isNfsV3Enabled": "[if(parameters('enableNfsV3'), parameters('enableNfsV3'), '')]",
-                "largeFileSharesState": "[if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null())]",
-                "minimumTlsVersion": "[parameters('minimumTlsVersion')]",
-                "networkAcls": "[if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny'))]",
-                "allowBlobPublicAccess": "[parameters('allowBlobPublicAccess')]",
-                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))]",
-                "azureFilesIdentityBasedAuthentication": "[if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), parameters('azureFilesIdentityBasedAuthentication'), null())]"
-              },
-              "dependsOn": [
-                "cMKKeyVault",
-                "cMKUserAssignedIdentity"
-              ]
-            },
-            "storageAccount_diagnosticSettings": {
-              "copy": {
-                "name": "storageAccount_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "storageAccount"
-              ]
+              "tags": "[parameters('tags')]"
             },
-            "storageAccount_lock": {
+            "privateDnsZone_lock": {
               "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
               "type": "Microsoft.Authorization/locks",
               "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
               "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
               "properties": {
                 "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                 "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
               },
               "dependsOn": [
-                "storageAccount"
+                "privateDnsZone"
               ]
             },
-            "storageAccount_roleAssignments": {
+            "privateDnsZone_roleAssignments": {
               "copy": {
-                "name": "storageAccount_roleAssignments",
+                "name": "privateDnsZone_roleAssignments",
                 "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
               },
               "type": "Microsoft.Authorization/roleAssignments",
               "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
               "properties": {
                 "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                 "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
@@ -4349,64 +4625,40 @@
                 "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
               },
               "dependsOn": [
-                "storageAccount"
+                "privateDnsZone"
               ]
             },
-            "storageAccount_privateEndpoints": {
+            "privateDnsZone_A": {
               "copy": {
-                "name": "storageAccount_privateEndpoints",
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                "name": "privateDnsZone_A",
+                "count": "[length(coalesce(parameters('a'), createArray()))]"
               },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-storageAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
-                  },
-                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                  "subnetResourceId": {
-                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                  },
-                  "enableTelemetry": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
                   },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  "name": {
+                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
                   },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  "aRecords": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
                   },
-                  "privateDnsZoneGroupName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "privateDnsZoneResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
                   },
                   "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "customDnsConfigs": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                  },
-                  "ipConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                  },
-                  "applicationSecurityGroupResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                  },
-                  "customNetworkInterfaceName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -4416,11 +4668,11 @@
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "4120048060064073955"
+                      "version": "0.28.1.47646",
+                      "templateHash": "8657463061873174631"
                     },
-                    "name": "Private Endpoints",
-                    "description": "This module deploys a Private Endpoint.",
+                    "name": "Private DNS Zone A record",
+                    "description": "This module deploys a Private DNS Zone A record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
@@ -4489,239 +4741,40 @@
                         }
                       },
                       "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
                     },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "nullable": true
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the A record."
+                      }
                     },
-                    "ipConfigurationsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the resource that is unique within a resource group."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "memberName": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateIPAddress": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private endpoint IP configurations."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "manualPrivateLinkServiceConnectionsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the private link service connection."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupIds": {
-                                "type": "array",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateLinkServiceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of private link service."
-                                }
-                              },
-                              "requestMessage": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private link service connection."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "privateLinkServiceConnectionsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the private link service connection."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupIds": {
-                                "type": "array",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateLinkServiceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of private link service."
-                                }
-                              },
-                              "requestMessage": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private link service connection."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "customDnsConfigType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "fqdn": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. Fqdn that resolves to private endpoint IP address."
-                            }
-                          },
-                          "ipAddresses": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            },
-                            "metadata": {
-                              "description": "Required. A list of private IP addresses of the private endpoint."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the private endpoint resource to create."
-                      }
-                    },
-                    "subnetResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                      }
-                    },
-                    "applicationSecurityGroupResourceIds": {
+                    "aRecords": {
                       "type": "array",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                      }
-                    },
-                    "customNetworkInterfaceName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                      }
-                    },
-                    "ipConfigurations": {
-                      "$ref": "#/definitions/ipConfigurationsType",
-                      "metadata": {
-                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                      }
-                    },
-                    "privateDnsZoneGroupName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                        "description": "Optional. The list of A records in the record set."
                       }
                     },
-                    "privateDnsZoneResourceIds": {
-                      "type": "array",
+                    "metadata": {
+                      "type": "object",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. The lock settings of the service."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
                     "roleAssignments": {
@@ -4729,124 +4782,48 @@
                       "metadata": {
                         "description": "Optional. Array of role assignments to create."
                       }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                      }
-                    },
-                    "customDnsConfigs": {
-                      "$ref": "#/definitions/customDnsConfigType",
-                      "metadata": {
-                        "description": "Optional. Custom DNS configurations."
-                      }
-                    },
-                    "manualPrivateLinkServiceConnections": {
-                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
-                      "metadata": {
-                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
-                      }
-                    },
-                    "privateLinkServiceConnections": {
-                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
-                      "metadata": {
-                        "description": "Optional. A grouping of information about the connection to the remote resource."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
                     }
                   },
                   "variables": {
                     "builtInRoleNames": {
                       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
                       "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
                       "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
                       "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
                     }
                   },
                   "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2023-07-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "A": {
+                      "type": "Microsoft.Network/privateDnsZones/A",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
                       "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "privateEndpoint": {
-                      "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "applicationSecurityGroups",
-                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                            "input": {
-                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                            }
-                          }
-                        ],
-                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                        "subnet": {
-                          "id": "[parameters('subnetResourceId')]"
-                        }
-                      }
-                    },
-                    "privateEndpoint_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                        "aRecords": "[parameters('aRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
                       },
                       "dependsOn": [
-                        "privateEndpoint"
+                        "privateDnsZone"
                       ]
                     },
-                    "privateEndpoint_roleAssignments": {
+                    "A_roleAssignments": {
                       "copy": {
-                        "name": "privateEndpoint_roleAssignments",
+                        "name": "A_roleAssignments",
                         "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
                       "type": "Microsoft.Authorization/roleAssignments",
                       "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/A/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
                         "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                         "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
@@ -4857,330 +4834,148 @@
                         "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                          },
-                          "privateDNSResourceIds": {
-                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
-                          },
-                          "privateEndpointName": {
-                            "value": "[parameters('name')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.25.53.49325",
-                              "templateHash": "11244630631275470040"
-                            },
-                            "name": "Private Endpoint Private DNS Zone Groups",
-                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
-                            "owner": "Azure/module-maintainers"
-                          },
-                          "parameters": {
-                            "privateEndpointName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "privateDNSResourceIds": {
-                              "type": "array",
-                              "minLength": 1,
-                              "maxLength": 5,
-                              "metadata": {
-                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the private DNS zone group."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneConfigs",
-                                "count": "[length(parameters('privateDNSResourceIds'))]",
-                                "input": {
-                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
-                                  "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
-                                  }
-                                }
-                              }
-                            ]
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                              "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint DNS zone group."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint DNS zone group."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint DNS zone group was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
+                        "A"
                       ]
                     }
                   },
                   "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the private endpoint was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the private endpoint."
-                      },
-                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                    },
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the private endpoint."
+                        "description": "The name of the deployed A record."
                       },
                       "value": "[parameters('name')]"
                     },
-                    "location": {
+                    "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The location the resource was deployed into."
+                        "description": "The resource ID of the deployed A record."
                       },
-                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
-                    "groupId": {
+                    "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The group Id for the private endpoint Group."
+                        "description": "The resource group of the deployed A record."
                       },
-                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                      "value": "[resourceGroup().name]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "storageAccount"
+                "privateDnsZone"
               ]
             },
-            "storageAccount_managementPolicies": {
-              "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]",
+            "privateDnsZone_AAAA": {
+              "copy": {
+                "name": "privateDnsZone_AAAA",
+                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+              },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
+              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "storageAccountName": {
+                  "privateDnsZoneName": {
                     "value": "[parameters('name')]"
                   },
-                  "rules": {
-                    "value": "[coalesce(parameters('managementPolicyRules'), createArray())]"
+                  "name": {
+                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                  },
+                  "aaaaRecords": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.28.1.47646",
-                      "templateHash": "9473195527943694039"
+                      "templateHash": "1725749611610769138"
                     },
-                    "name": "Storage Account Management Policies",
-                    "description": "This module deploys a Storage Account Management Policy.",
+                    "name": "Private DNS Zone AAAA record",
+                    "description": "This module deploys a Private DNS Zone AAAA record.",
                     "owner": "Azure/module-maintainers"
                   },
-                  "parameters": {
-                    "storageAccountName": {
-                      "type": "string",
-                      "maxLength": 24,
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "rules": {
+                  "definitions": {
+                    "roleAssignmentType": {
                       "type": "array",
-                      "metadata": {
-                        "description": "Required. The Storage Account ManagementPolicies Rules."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "Microsoft.Storage/storageAccounts/managementPolicies",
-                      "apiVersion": "2023-01-01",
-                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
-                      "properties": {
-                        "policy": {
-                          "rules": "[parameters('rules')]"
-                        }
-                      }
-                    }
-                  ],
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed management policy."
-                      },
-                      "value": "default"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed management policy."
-                      },
-                      "value": "default"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed management policy."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "storageAccount",
-                "storageAccount_blobServices"
-              ]
-            },
-            "storageAccount_localUsers": {
-              "copy": {
-                "name": "storageAccount_localUsers",
-                "count": "[length(parameters('localUsers'))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "storageAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "name": {
-                    "value": "[parameters('localUsers')[copyIndex()].name]"
-                  },
-                  "hasSshKey": {
-                    "value": "[parameters('localUsers')[copyIndex()].hasSshKey]"
-                  },
-                  "hasSshPassword": {
-                    "value": "[parameters('localUsers')[copyIndex()].hasSshPassword]"
-                  },
-                  "permissionScopes": {
-                    "value": "[parameters('localUsers')[copyIndex()].permissionScopes]"
-                  },
-                  "hasSharedKey": {
-                    "value": "[tryGet(parameters('localUsers')[copyIndex()], 'hasSharedKey')]"
-                  },
-                  "homeDirectory": {
-                    "value": "[tryGet(parameters('localUsers')[copyIndex()], 'homeDirectory')]"
-                  },
-                  "sshAuthorizedKeys": {
-                    "value": "[tryGet(parameters('localUsers')[copyIndex()], 'sshAuthorizedKeys')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "14968464858285923305"
-                    },
-                    "name": "Storage Account Local Users",
-                    "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "sshAuthorizedKeysType": {
-                      "type": "secureObject",
-                      "properties": {
-                        "secureList": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "description": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Description used to store the function/usage of the key."
-                                }
-                              },
-                              "key": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
-                                }
-                              }
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                             }
                           },
-                          "metadata": {
-                            "description": "Optional. The list of SSH authorized keys."
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
                           }
                         }
                       },
@@ -5188,79 +4983,97 @@
                     }
                   },
                   "parameters": {
-                    "storageAccountName": {
+                    "privateDnsZoneName": {
                       "type": "string",
-                      "maxLength": 24,
                       "metadata": {
-                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. The name of the local user used for SFTP Authentication."
-                      }
-                    },
-                    "hasSharedKey": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
-                      }
-                    },
-                    "hasSshKey": {
-                      "type": "bool",
-                      "metadata": {
-                        "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                        "description": "Required. The name of the AAAA record."
                       }
                     },
-                    "hasSshPassword": {
-                      "type": "bool",
+                    "aaaaRecords": {
+                      "type": "array",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                        "description": "Optional. The list of AAAA records in the record set."
                       }
                     },
-                    "homeDirectory": {
-                      "type": "string",
-                      "defaultValue": "",
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. The local user home directory."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "permissionScopes": {
-                      "type": "array",
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Required. The permission scopes of the local user."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
-                    "sshAuthorizedKeys": {
-                      "$ref": "#/definitions/sshAuthorizedKeysType",
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
                       "metadata": {
-                        "description": "Optional. The local user SSH authorized keys for SFTP."
+                        "description": "Optional. Array of role assignments to create."
                       }
                     }
                   },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
                   "resources": {
-                    "storageAccount": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('storageAccountName')]"
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "AAAA": {
+                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
                     },
-                    "localUsers": {
-                      "type": "Microsoft.Storage/storageAccounts/localUsers",
-                      "apiVersion": "2023-04-01",
-                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                    "AAAA_roleAssignments": {
+                      "copy": {
+                        "name": "AAAA_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/AAAA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
-                        "hasSharedKey": "[parameters('hasSharedKey')]",
-                        "hasSshKey": "[parameters('hasSshKey')]",
-                        "hasSshPassword": "[parameters('hasSshPassword')]",
-                        "homeDirectory": "[parameters('homeDirectory')]",
-                        "permissionScopes": "[parameters('permissionScopes')]",
-                        "sshAuthorizedKeys": "[tryGet(parameters('sshAuthorizedKeys'), 'secureList')]"
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "storageAccount"
+                        "AAAA"
                       ]
                     }
                   },
@@ -5268,95 +5081,62 @@
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the deployed local user."
+                        "description": "The name of the deployed AAAA record."
                       },
                       "value": "[parameters('name')]"
                     },
-                    "resourceGroupName": {
+                    "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group of the deployed local user."
+                        "description": "The resource ID of the deployed AAAA record."
                       },
-                      "value": "[resourceGroup().name]"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
-                    "resourceId": {
+                    "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the deployed local user."
+                        "description": "The resource group of the deployed AAAA record."
                       },
-                      "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
+                      "value": "[resourceGroup().name]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "storageAccount"
+                "privateDnsZone"
               ]
             },
-            "storageAccount_blobServices": {
-              "condition": "[not(empty(parameters('blobServices')))]",
+            "privateDnsZone_CNAME": {
+              "copy": {
+                "name": "privateDnsZone_CNAME",
+                "count": "[length(coalesce(parameters('cname'), createArray()))]"
+              },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
+              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "storageAccountName": {
+                  "privateDnsZoneName": {
                     "value": "[parameters('name')]"
                   },
-                  "containers": {
-                    "value": "[tryGet(parameters('blobServices'), 'containers')]"
-                  },
-                  "automaticSnapshotPolicyEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
-                  },
-                  "changeFeedEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
-                  },
-                  "changeFeedRetentionInDays": {
-                    "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
-                  },
-                  "containerDeleteRetentionPolicyEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
+                  "name": {
+                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
                   },
-                  "containerDeleteRetentionPolicyDays": {
-                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
+                  "cnameRecord": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
                   },
-                  "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "corsRules": {
-                    "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
                   },
-                  "defaultServiceVersion": {
-                    "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
-                  },
-                  "deleteRetentionPolicyAllowPermanentDelete": {
-                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
-                  },
-                  "deleteRetentionPolicyEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
-                  },
-                  "deleteRetentionPolicyDays": {
-                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
-                  },
-                  "isVersioningEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
-                  },
-                  "lastAccessTimeTrackingPolicyEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
-                  },
-                  "restorePolicyEnabled": {
-                    "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
-                  },
-                  "restorePolicyDays": {
-                    "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -5367,127 +5147,73 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.28.1.47646",
-                      "templateHash": "2306287879023715578"
+                      "templateHash": "12750497126800708872"
                     },
-                    "name": "Storage Account blob Services",
-                    "description": "This module deploys a Storage Account Blob Service.",
+                    "name": "Private DNS Zone CNAME record",
+                    "description": "This module deploys a Private DNS Zone CNAME record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
-                    "diagnosticSettingType": {
+                    "roleAssignmentType": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "properties": {
-                          "name": {
+                          "roleDefinitionIdOrName": {
                             "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name of diagnostic setting."
-                            }
-                          },
-                          "logCategoriesAndGroups": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                  }
-                                },
-                                "categoryGroup": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
-                            "nullable": true,
                             "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                             }
                           },
-                          "metricCategories": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
-                            "nullable": true,
+                          "principalId": {
+                            "type": "string",
                             "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                             }
                           },
-                          "logAnalyticsDestinationType": {
+                          "principalType": {
                             "type": "string",
                             "allowedValues": [
-                              "AzureDiagnostics",
-                              "Dedicated"
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
                             ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                            }
-                          },
-                          "workspaceResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. The principal type of the assigned principal ID."
                             }
                           },
-                          "storageAccountResourceId": {
+                          "description": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. The description of the role assignment."
                             }
                           },
-                          "eventHubAuthorizationRuleResourceId": {
+                          "condition": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                             }
                           },
-                          "eventHubName": {
+                          "conditionVersion": {
                             "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. Version of the condition."
                             }
                           },
-                          "marketplacePartnerResourceId": {
+                          "delegatedManagedIdentityResourceId": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
@@ -5496,678 +5222,597 @@
                     }
                   },
                   "parameters": {
-                    "storageAccountName": {
+                    "privateDnsZoneName": {
                       "type": "string",
-                      "maxLength": 24,
-                      "metadata": {
-                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "automaticSnapshotPolicyEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
                       "metadata": {
-                        "description": "Optional. Automatic Snapshot is enabled if set to true."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "changeFeedEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
+                    "name": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                        "description": "Required. The name of the CNAME record."
                       }
                     },
-                    "changeFeedRetentionInDays": {
-                      "type": "int",
+                    "cnameRecord": {
+                      "type": "object",
                       "nullable": true,
-                      "minValue": 1,
-                      "maxValue": 146000,
-                      "metadata": {
-                        "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
-                      }
-                    },
-                    "containerDeleteRetentionPolicyEnabled": {
-                      "type": "bool",
-                      "defaultValue": true,
                       "metadata": {
-                        "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                        "description": "Optional. A CNAME record."
                       }
                     },
-                    "containerDeleteRetentionPolicyDays": {
-                      "type": "int",
+                    "metadata": {
+                      "type": "object",
                       "nullable": true,
-                      "minValue": 1,
-                      "maxValue": 365,
                       "metadata": {
-                        "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                      "type": "bool",
-                      "defaultValue": false,
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
-                    "corsRules": {
-                      "type": "array",
-                      "defaultValue": [],
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
                       "metadata": {
-                        "description": "Optional. Specifies CORS rules for the Blob service. You can include up to five CorsRule elements in the request. If no CorsRule elements are included in the request body, all CORS rules will be deleted, and CORS will be disabled for the Blob service."
+                        "description": "Optional. Array of role assignments to create."
                       }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "CNAME": {
+                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "cnameRecord": "[parameters('cnameRecord')]",
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
                     },
-                    "defaultServiceVersion": {
+                    "CNAME_roleAssignments": {
+                      "copy": {
+                        "name": "CNAME_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/CNAME/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "CNAME"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
                       "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
-                      }
-                    },
-                    "deleteRetentionPolicyEnabled": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. The blob service properties for blob soft delete."
-                      }
-                    },
-                    "deleteRetentionPolicyDays": {
-                      "type": "int",
-                      "defaultValue": 7,
-                      "minValue": 1,
-                      "maxValue": 365,
                       "metadata": {
-                        "description": "Optional. Indicates the number of days that the deleted blob should be retained."
-                      }
+                        "description": "The name of the deployed CNAME record."
+                      },
+                      "value": "[parameters('name')]"
                     },
-                    "deleteRetentionPolicyAllowPermanentDelete": {
-                      "type": "bool",
-                      "defaultValue": false,
+                    "resourceId": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                      }
+                        "description": "The resource ID of the deployed CNAME record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
-                    "isVersioningEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
+                    "resourceGroupName": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. Use versioning to automatically maintain previous versions of your blobs."
-                      }
+                        "description": "The resource group of the deployed CNAME record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_MX": {
+              "copy": {
+                "name": "privateDnsZone_MX",
+                "count": "[length(coalesce(parameters('mx'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "mxRecords": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "13512848802819943036"
                     },
-                    "lastAccessTimeTrackingPolicyEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
+                    "name": "Private DNS Zone MX record",
+                    "description": "This module deploys a Private DNS Zone MX record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "restorePolicyEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
+                    "name": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                        "description": "Required. The name of the MX record."
                       }
                     },
-                    "restorePolicyDays": {
-                      "type": "int",
-                      "defaultValue": 6,
-                      "minValue": 1,
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "containers": {
+                    "mxRecords": {
                       "type": "array",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Blob containers to create."
+                        "description": "Optional. The list of MX records in the record set."
                       }
                     },
-                    "diagnosticSettings": {
-                      "$ref": "#/definitions/diagnosticSettingType",
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
                       }
                     }
                   },
                   "variables": {
-                    "name": "default"
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
                   },
                   "resources": {
-                    "storageAccount": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2022-09-01",
-                      "name": "[parameters('storageAccountName')]"
-                    },
-                    "blobServices": {
-                      "type": "Microsoft.Storage/storageAccounts/blobServices",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "MX": {
+                      "type": "Microsoft.Network/privateDnsZones/MX",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
                       "properties": {
-                        "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
-                        "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
-                        "containerDeleteRetentionPolicy": {
-                          "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
-                          "days": "[parameters('containerDeleteRetentionPolicyDays')]",
-                          "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
-                        },
-                        "cors": {
-                          "corsRules": "[parameters('corsRules')]"
-                        },
-                        "defaultServiceVersion": "[if(not(empty(parameters('defaultServiceVersion'))), parameters('defaultServiceVersion'), null())]",
-                        "deleteRetentionPolicy": {
-                          "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
-                          "days": "[parameters('deleteRetentionPolicyDays')]",
-                          "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
-                        },
-                        "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
-                        "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2022-09-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
-                        "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
+                        "metadata": "[parameters('metadata')]",
+                        "mxRecords": "[parameters('mxRecords')]",
+                        "ttl": "[parameters('ttl')]"
                       },
                       "dependsOn": [
-                        "storageAccount"
+                        "privateDnsZone"
                       ]
                     },
-                    "blobServices_diagnosticSettings": {
+                    "MX_roleAssignments": {
                       "copy": {
-                        "name": "blobServices_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                        "name": "MX_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/MX/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "blobServices"
+                        "MX"
                       ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed MX record."
+                      },
+                      "value": "[parameters('name')]"
                     },
-                    "blobServices_container": {
-                      "copy": {
-                        "name": "blobServices_container",
-                        "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed MX record."
                       },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('storageAccountName')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
-                          },
-                          "defaultEncryptionScope": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
-                          },
-                          "denyEncryptionScopeOverride": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
-                          },
-                          "enableNfsV3AllSquash": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
-                          },
-                          "enableNfsV3RootSquash": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
-                          },
-                          "immutableStorageWithVersioningEnabled": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
-                          },
-                          "metadata": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed MX record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_PTR": {
+              "copy": {
+                "name": "privateDnsZone_PTR",
+                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "ptrRecords": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "5069219418696231980"
+                    },
+                    "name": "Private DNS Zone PTR record",
+                    "description": "This module deploys a Private DNS Zone PTR record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
                           },
-                          "publicAccess": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
                           },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
                           },
-                          "immutabilityPolicyProperties": {
-                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicyProperties')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.28.1.47646",
-                              "templateHash": "7045309160947869799"
-                            },
-                            "name": "Storage Account Blob Containers",
-                            "description": "This module deploys a Storage Account Blob Container.",
-                            "owner": "Azure/module-maintainers"
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
                           },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "roleDefinitionIdOrName": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                    }
-                                  },
-                                  "principalId": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                    }
-                                  },
-                                  "principalType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Device",
-                                      "ForeignGroup",
-                                      "Group",
-                                      "ServicePrincipal",
-                                      "User"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The principal type of the assigned principal ID."
-                                    }
-                                  },
-                                  "description": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The description of the role assignment."
-                                    }
-                                  },
-                                  "condition": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                    }
-                                  },
-                                  "conditionVersion": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "2.0"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Version of the condition."
-                                    }
-                                  },
-                                  "delegatedManagedIdentityResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                             }
                           },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the storage container to deploy."
-                              }
-                            },
-                            "defaultEncryptionScope": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. Default the container to use specified encryption scope for all writes."
-                              }
-                            },
-                            "denyEncryptionScopeOverride": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Block override of encryption scope from the container default."
-                              }
-                            },
-                            "enableNfsV3AllSquash": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Enable NFSv3 all squash on blob container."
-                              }
-                            },
-                            "enableNfsV3RootSquash": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Enable NFSv3 root squash on blob container."
-                              }
-                            },
-                            "immutableStorageWithVersioningEnabled": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                              }
-                            },
-                            "immutabilityPolicyName": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. Name of the immutable policy."
-                              }
-                            },
-                            "immutabilityPolicyProperties": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Configure immutability policy."
-                              }
-                            },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
                             "metadata": {
-                              "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Optional. A name-value pair to associate with the container as metadata."
-                              }
-                            },
-                            "publicAccess": {
-                              "type": "string",
-                              "defaultValue": "None",
-                              "allowedValues": [
-                                "Container",
-                                "Blob",
-                                "None"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                              }
-                            },
-                            "roleAssignments": {
-                              "$ref": "#/definitions/roleAssignmentType",
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                              "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-                              "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-                              "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
-                              "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
-                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                            }
-                          },
-                          "resources": {
-                            "storageAccount::blobServices": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts/blobServices",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
-                              "dependsOn": [
-                                "storageAccount"
-                              ]
-                            },
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2022-09-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "container": {
-                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                              "properties": {
-                                "defaultEncryptionScope": "[if(not(empty(parameters('defaultEncryptionScope'))), parameters('defaultEncryptionScope'), null())]",
-                                "denyEncryptionScopeOverride": "[if(equals(parameters('denyEncryptionScopeOverride'), true()), parameters('denyEncryptionScopeOverride'), null())]",
-                                "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
-                                "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
-                                "immutableStorageWithVersioning": "[if(equals(parameters('immutableStorageWithVersioningEnabled'), true()), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
-                                "metadata": "[parameters('metadata')]",
-                                "publicAccess": "[parameters('publicAccess')]"
-                              },
-                              "dependsOn": [
-                                "storageAccount::blobServices"
-                              ]
-                            },
-                            "container_roleAssignments": {
-                              "copy": {
-                                "name": "container_roleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
-                              "properties": {
-                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "container"
-                              ]
-                            },
-                            "immutabilityPolicy": {
-                              "condition": "[not(empty(coalesce(parameters('immutabilityPolicyProperties'), createObject())))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[parameters('immutabilityPolicyName')]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountName')]"
-                                  },
-                                  "containerName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "immutabilityPeriodSinceCreationInDays": {
-                                    "value": "[tryGet(parameters('immutabilityPolicyProperties'), 'immutabilityPeriodSinceCreationInDays')]"
-                                  },
-                                  "allowProtectedAppendWrites": {
-                                    "value": "[tryGet(parameters('immutabilityPolicyProperties'), 'allowProtectedAppendWrites')]"
-                                  },
-                                  "allowProtectedAppendWritesAll": {
-                                    "value": "[tryGet(parameters('immutabilityPolicyProperties'), 'allowProtectedAppendWritesAll')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.28.1.47646",
-                                      "templateHash": "2543276032744560941"
-                                    },
-                                    "name": "Storage Account Blob Container Immutability Policies",
-                                    "description": "This module deploys a Storage Account Blob Container Immutability Policy.",
-                                    "owner": "Azure/module-maintainers"
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "containerName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "immutabilityPeriodSinceCreationInDays": {
-                                      "type": "int",
-                                      "defaultValue": 365,
-                                      "metadata": {
-                                        "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                      }
-                                    },
-                                    "allowProtectedAppendWrites": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                                      }
-                                    },
-                                    "allowProtectedAppendWritesAll": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]",
-                                      "properties": {
-                                        "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
-                                        "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
-                                        "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
-                                      }
-                                    }
-                                  ],
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the deployed immutability policy."
-                                      },
-                                      "value": "default"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the deployed immutability policy."
-                                      },
-                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group of the deployed immutability policy."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "container",
-                                "storageAccount"
-                              ]
+                              "description": "Optional. Version of the condition."
                             }
                           },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed container."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed container."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed container."
-                              },
-                              "value": "[resourceGroup().name]"
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
                       },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
+                      "nullable": true
                     }
                   },
-                  "outputs": {
-                    "name": {
+                  "parameters": {
+                    "privateDnsZoneName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the deployed blob service."
-                      },
-                      "value": "[variables('name')]"
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
                     },
-                    "resourceId": {
+                    "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the deployed blob service."
-                      },
-                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
+                        "description": "Required. The name of the PTR record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ptrRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of PTR records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "PTR": {
+                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ptrRecords": "[parameters('ptrRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "PTR_roleAssignments": {
+                      "copy": {
+                        "name": "PTR_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/PTR/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "PTR"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed PTR record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed PTR record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
                     },
                     "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the deployed blob service."
+                        "description": "The resource group of the deployed PTR record."
                       },
                       "value": "[resourceGroup().name]"
                     }
@@ -6175,34 +5820,40 @@
                 }
               },
               "dependsOn": [
-                "storageAccount"
+                "privateDnsZone"
               ]
             },
-            "storageAccount_fileServices": {
-              "condition": "[not(empty(parameters('fileServices')))]",
+            "privateDnsZone_SOA": {
+              "copy": {
+                "name": "privateDnsZone_SOA",
+                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+              },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
+              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "storageAccountName": {
+                  "privateDnsZoneName": {
                     "value": "[parameters('name')]"
                   },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
+                  "name": {
+                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
                   },
-                  "protocolSettings": {
-                    "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
                   },
-                  "shareDeleteRetentionPolicy": {
-                    "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
+                  "soaRecord": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
                   },
-                  "shares": {
-                    "value": "[tryGet(parameters('fileServices'), 'shares')]"
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
                   }
                 },
                 "template": {
@@ -6213,127 +5864,73 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.28.1.47646",
-                      "templateHash": "7463227074634701879"
+                      "templateHash": "8649693365938652763"
                     },
-                    "name": "Storage Account File Share Services",
-                    "description": "This module deploys a Storage Account File Share Service.",
+                    "name": "Private DNS Zone SOA record",
+                    "description": "This module deploys a Private DNS Zone SOA record.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
-                    "diagnosticSettingType": {
+                    "roleAssignmentType": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "properties": {
-                          "name": {
+                          "roleDefinitionIdOrName": {
                             "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name of diagnostic setting."
-                            }
-                          },
-                          "logCategoriesAndGroups": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                  }
-                                },
-                                "categoryGroup": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
-                            "nullable": true,
                             "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                             }
                           },
-                          "metricCategories": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
-                            "nullable": true,
+                          "principalId": {
+                            "type": "string",
                             "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                             }
                           },
-                          "logAnalyticsDestinationType": {
+                          "principalType": {
                             "type": "string",
                             "allowedValues": [
-                              "AzureDiagnostics",
-                              "Dedicated"
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
                             ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                            }
-                          },
-                          "workspaceResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. The principal type of the assigned principal ID."
                             }
                           },
-                          "storageAccountResourceId": {
+                          "description": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. The description of the role assignment."
                             }
                           },
-                          "eventHubAuthorizationRuleResourceId": {
+                          "condition": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                             }
                           },
-                          "eventHubName": {
+                          "conditionVersion": {
                             "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. Version of the condition."
                             }
                           },
-                          "marketplacePartnerResourceId": {
+                          "delegatedManagedIdentityResourceId": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
@@ -6342,748 +5939,476 @@
                     }
                   },
                   "parameters": {
-                    "storageAccountName": {
+                    "privateDnsZoneName": {
                       "type": "string",
-                      "maxLength": 24,
                       "metadata": {
-                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
                     "name": {
                       "type": "string",
-                      "defaultValue": "default",
                       "metadata": {
-                        "description": "Optional. The name of the file service."
+                        "description": "Required. The name of the SOA record."
                       }
                     },
-                    "protocolSettings": {
+                    "metadata": {
                       "type": "object",
-                      "defaultValue": {},
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. Protocol settings for file service."
+                        "description": "Optional. The metadata attached to the record set."
                       }
                     },
-                    "shareDeleteRetentionPolicy": {
+                    "soaRecord": {
                       "type": "object",
-                      "defaultValue": {
-                        "enabled": true,
-                        "days": 7
-                      },
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. The service properties for soft delete."
+                        "description": "Optional. A SOA record."
                       }
                     },
-                    "diagnosticSettings": {
-                      "$ref": "#/definitions/diagnosticSettingType",
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
                       "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
                       }
                     },
-                    "shares": {
-                      "type": "array",
-                      "nullable": true,
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
                       "metadata": {
-                        "description": "Optional. File shares to create."
+                        "description": "Optional. Array of role assignments to create."
                       }
                     }
                   },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
                   "resources": {
-                    "storageAccount": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('storageAccountName')]"
-                    },
-                    "fileServices": {
-                      "type": "Microsoft.Storage/storageAccounts/fileServices",
-                      "apiVersion": "2023-04-01",
-                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SOA": {
+                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
                       "properties": {
-                        "protocolSettings": "[parameters('protocolSettings')]",
-                        "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
+                        "metadata": "[parameters('metadata')]",
+                        "soaRecord": "[parameters('soaRecord')]",
+                        "ttl": "[parameters('ttl')]"
                       },
                       "dependsOn": [
-                        "storageAccount"
+                        "privateDnsZone"
                       ]
                     },
-                    "fileServices_diagnosticSettings": {
+                    "SOA_roleAssignments": {
                       "copy": {
-                        "name": "fileServices_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                        "name": "SOA_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SOA/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "fileServices"
+                        "SOA"
                       ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SOA record."
+                      },
+                      "value": "[parameters('name')]"
                     },
-                    "fileServices_shares": {
-                      "copy": {
-                        "name": "fileServices_shares",
-                        "count": "[length(coalesce(parameters('shares'), createArray()))]"
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SOA record."
                       },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('storageAccountName')]"
-                          },
-                          "fileServicesName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
-                          },
-                          "accessTier": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2023-04-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]"
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SOA record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_SRV": {
+              "copy": {
+                "name": "privateDnsZone_SRV",
+                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "srvRecords": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "1580431299497536987"
+                    },
+                    "name": "Private DNS Zone SRV record",
+                    "description": "This module deploys a Private DNS Zone SRV record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
                           },
-                          "enabledProtocols": {
-                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
                           },
-                          "rootSquash": {
-                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
                           },
-                          "shareQuota": {
-                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
                           },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.28.1.47646",
-                              "templateHash": "1342480740201032357"
-                            },
-                            "name": "Storage Account File Shares",
-                            "description": "This module deploys a Storage Account File Share.",
-                            "owner": "Azure/module-maintainers"
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
                           },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "roleDefinitionIdOrName": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                    }
-                                  },
-                                  "principalId": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                    }
-                                  },
-                                  "principalType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Device",
-                                      "ForeignGroup",
-                                      "Group",
-                                      "ServicePrincipal",
-                                      "User"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The principal type of the assigned principal ID."
-                                    }
-                                  },
-                                  "description": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The description of the role assignment."
-                                    }
-                                  },
-                                  "condition": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                    }
-                                  },
-                                  "conditionVersion": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "2.0"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Version of the condition."
-                                    }
-                                  },
-                                  "delegatedManagedIdentityResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
                             }
                           },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "fileServicesName": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the file share to create."
-                              }
-                            },
-                            "accessTier": {
-                              "type": "string",
-                              "defaultValue": "TransactionOptimized",
-                              "allowedValues": [
-                                "Premium",
-                                "Hot",
-                                "Cool",
-                                "TransactionOptimized"
-                              ],
-                              "metadata": {
-                                "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
-                              }
-                            },
-                            "shareQuota": {
-                              "type": "int",
-                              "defaultValue": 5120,
-                              "metadata": {
-                                "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
-                              }
-                            },
-                            "enabledProtocols": {
-                              "type": "string",
-                              "defaultValue": "SMB",
-                              "allowedValues": [
-                                "NFS",
-                                "SMB"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
-                              }
-                            },
-                            "rootSquash": {
-                              "type": "string",
-                              "defaultValue": "NoRootSquash",
-                              "allowedValues": [
-                                "AllSquash",
-                                "NoRootSquash",
-                                "RootSquash"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
-                              }
-                            },
-                            "roleAssignments": {
-                              "$ref": "#/definitions/roleAssignmentType",
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the SRV record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "srvRecords": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of SRV records in the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "SRV": {
+                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "srvRecords": "[parameters('srvRecords')]",
+                        "ttl": "[parameters('ttl')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "SRV_roleAssignments": {
+                      "copy": {
+                        "name": "SRV_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/SRV/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "SRV"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SRV record."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SRV record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SRV record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_TXT": {
+              "copy": {
+                "name": "privateDnsZone_TXT",
+                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                  },
+                  "metadata": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                  },
+                  "txtRecords": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                  },
+                  "ttl": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "1628766837655887758"
+                    },
+                    "name": "Private DNS Zone TXT record",
+                    "description": "This module deploys a Private DNS Zone TXT record.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                             }
                           },
-                          "resources": {
-                            "storageAccount::fileService": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts/fileServices",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]",
-                              "dependsOn": [
-                                "storageAccount"
-                              ]
-                            },
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2023-04-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "fileShare": {
-                              "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
-                              "apiVersion": "2023-01-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
-                              "properties": {
-                                "accessTier": "[parameters('accessTier')]",
-                                "shareQuota": "[parameters('shareQuota')]",
-                                "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
-                                "enabledProtocols": "[parameters('enabledProtocols')]"
-                              },
-                              "dependsOn": [
-                                "storageAccount::fileService"
-                              ]
-                            },
-                            "fileShare_roleAssignments": {
-                              "condition": "[not(empty(parameters('roleAssignments')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-Share-Rbac', uniqueString(deployment().name))]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "fileShareResourceId": {
-                                    "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[parameters('roleAssignments')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.28.1.47646",
-                                      "templateHash": "8779226603522513073"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    },
-                                    "fileShareResourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource id of the file share to assign the roles to."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "$fxv#0": {
-                                      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                      "contentVersion": "1.0.0.0",
-                                      "parameters": {
-                                        "scope": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The scope to deploy the role assignment to."
-                                          }
-                                        },
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the role assignment."
-                                          }
-                                        },
-                                        "roleDefinitionId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role definition Id to assign."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User",
-                                            ""
-                                          ],
-                                          "defaultValue": "",
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "defaultValue": "",
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "defaultValue": "",
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "defaultValue": "2.0",
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "defaultValue": "",
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "resources": [
-                                        {
-                                          "type": "Microsoft.Authorization/roleAssignments",
-                                          "apiVersion": "2022-04-01",
-                                          "scope": "[[parameters('scope')]",
-                                          "name": "[[parameters('name')]",
-                                          "properties": {
-                                            "roleDefinitionId": "[[parameters('roleDefinitionId')]",
-                                            "principalId": "[[parameters('principalId')]",
-                                            "description": "[[parameters('description')]",
-                                            "principalType": "[[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
-                                            "condition": "[[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
-                                            "conditionVersion": "[[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
-                                            "delegatedManagedIdentityResourceId": "[[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
-                                          }
-                                        }
-                                      ]
-                                    },
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
-                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
-                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "copy": {
-                                        "name": "fileShare_roleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2021-04-01",
-                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "expressionEvaluationOptions": {
-                                          "scope": "Outer"
-                                        },
-                                        "template": "[variables('$fxv#0')]",
-                                        "parameters": {
-                                          "scope": {
-                                            "value": "[replace(parameters('fileShareResourceId'), '/shares/', '/fileShares/')]"
-                                          },
-                                          "name": {
-                                            "value": "[guid(parameters('fileShareResourceId'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, 'tyfa')]"
-                                          },
-                                          "roleDefinitionId": {
-                                            "value": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]"
-                                          },
-                                          "principalId": {
-                                            "value": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]"
-                                          },
-                                          "principalType": {
-                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]"
-                                          },
-                                          "description": {
-                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]"
-                                          },
-                                          "condition": {
-                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]"
-                                          },
-                                          "conditionVersion": {
-                                            "value": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]"
-                                          },
-                                          "delegatedManagedIdentityResourceId": {
-                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                          }
-                                        }
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "fileShare"
-                              ]
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                             }
                           },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed file share."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed file share."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed file share."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "fileServices",
-                        "storageAccount"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed file share service."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed file share service."
-                      },
-                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed file share service."
-                      },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "storageAccount"
-              ]
-            },
-            "storageAccount_queueServices": {
-              "condition": "[not(empty(parameters('queueServices')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "storageAccountName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
-                  },
-                  "queues": {
-                    "value": "[tryGet(parameters('queueServices'), 'queues')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "10678250016540336570"
-                    },
-                    "name": "Storage Account Queue Services",
-                    "description": "This module deploys a Storage Account Queue Service.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "definitions": {
-                    "diagnosticSettingType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name of diagnostic setting."
-                            }
-                          },
-                          "logCategoriesAndGroups": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                  }
-                                },
-                                "categoryGroup": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                            }
-                          },
-                          "metricCategories": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                            }
-                          },
-                          "logAnalyticsDestinationType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "AzureDiagnostics",
-                              "Dedicated"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                            }
-                          },
-                          "workspaceResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
                             }
                           },
-                          "storageAccountResourceId": {
+                          "description": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. The description of the role assignment."
                             }
                           },
-                          "eventHubAuthorizationRuleResourceId": {
+                          "condition": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                             }
                           },
-                          "eventHubName": {
+                          "conditionVersion": {
                             "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. Version of the condition."
                             }
                           },
-                          "marketplacePartnerResourceId": {
+                          "delegatedManagedIdentityResourceId": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                             }
                           }
                         }
@@ -7092,318 +6417,16388 @@
                     }
                   },
                   "parameters": {
-                    "storageAccountName": {
+                    "privateDnsZoneName": {
                       "type": "string",
-                      "maxLength": 24,
                       "metadata": {
-                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "queues": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the TXT record."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The metadata attached to the record set."
+                      }
+                    },
+                    "ttl": {
+                      "type": "int",
+                      "defaultValue": 3600,
+                      "metadata": {
+                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                      }
+                    },
+                    "txtRecords": {
                       "type": "array",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. Queues to create."
+                        "description": "Optional. The list of TXT records in the record set."
                       }
                     },
-                    "diagnosticSettings": {
-                      "$ref": "#/definitions/diagnosticSettingType",
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
                       "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
+                        "description": "Optional. Array of role assignments to create."
                       }
                     }
                   },
                   "variables": {
-                    "name": "default"
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
                   },
                   "resources": {
-                    "storageAccount": {
+                    "privateDnsZone": {
                       "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('storageAccountName')]"
-                    },
-                    "queueServices": {
-                      "type": "Microsoft.Storage/storageAccounts/queueServices",
-                      "apiVersion": "2023-04-01",
-                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                      "properties": {},
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "TXT": {
+                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "properties": {
+                        "metadata": "[parameters('metadata')]",
+                        "ttl": "[parameters('ttl')]",
+                        "txtRecords": "[parameters('txtRecords')]"
+                      },
                       "dependsOn": [
-                        "storageAccount"
+                        "privateDnsZone"
                       ]
                     },
-                    "queueServices_diagnosticSettings": {
+                    "TXT_roleAssignments": {
                       "copy": {
-                        "name": "queueServices_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                        "name": "TXT_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
                       },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}/TXT/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
                       "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
-                        "queueServices"
+                        "TXT"
                       ]
-                    },
-                    "queueServices_queues": {
-                      "copy": {
-                        "name": "queueServices_queues",
-                        "count": "[length(coalesce(parameters('queues'), createArray()))]"
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed TXT record."
                       },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed TXT record."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed TXT record."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            },
+            "privateDnsZone_virtualNetworkLinks": {
+              "copy": {
+                "name": "privateDnsZone_virtualNetworkLinks",
+                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-PrivateDnsZone-VirtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "privateDnsZoneName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                  },
+                  "virtualNetworkResourceId": {
+                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                  },
+                  "registrationEnabled": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "8423159394395901832"
+                    },
+                    "name": "Private DNS Zone Virtual Network Link",
+                    "description": "This module deploys a Private DNS Zone Virtual Network Link.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "privateDnsZoneName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                      "metadata": {
+                        "description": "Optional. The name of the virtual network link."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "global",
+                      "metadata": {
+                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "registrationEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                      }
+                    },
+                    "virtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Link to another virtual network resource ID."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "privateDnsZone": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('privateDnsZoneName')]"
+                    },
+                    "virtualNetworkLink": {
+                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                      "apiVersion": "2020-06-01",
+                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
                       "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('storageAccountName')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
-                          },
-                          "metadata": {
-                            "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.28.1.47646",
-                              "templateHash": "13487964166280180730"
-                            },
-                            "name": "Storage Account Queues",
-                            "description": "This module deploys a Storage Account Queue.",
-                            "owner": "Azure/module-maintainers"
-                          },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "roleDefinitionIdOrName": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                    }
-                                  },
-                                  "principalId": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                    }
-                                  },
-                                  "principalType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Device",
-                                      "ForeignGroup",
-                                      "Group",
-                                      "ServicePrincipal",
-                                      "User"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The principal type of the assigned principal ID."
-                                    }
-                                  },
-                                  "description": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The description of the role assignment."
-                                    }
-                                  },
-                                  "condition": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                    }
-                                  },
-                                  "conditionVersion": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "2.0"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Version of the condition."
-                                    }
-                                  },
-                                  "delegatedManagedIdentityResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the storage queue to deploy."
-                              }
-                            },
-                            "metadata": {
-                              "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Required. A name-value pair that represents queue metadata."
-                              }
-                            },
-                            "roleAssignments": {
-                              "$ref": "#/definitions/roleAssignmentType",
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                              "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-                              "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
-                              "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
-                              "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
-                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                            }
-                          },
-                          "resources": {
-                            "storageAccount::queueServices": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts/queueServices",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
-                              "dependsOn": [
-                                "storageAccount"
-                              ]
-                            },
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2023-04-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "queue": {
-                              "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                              "properties": {
-                                "metadata": "[parameters('metadata')]"
-                              },
-                              "dependsOn": [
-                                "storageAccount::queueServices"
-                              ]
-                            },
-                            "queue_roleAssignments": {
-                              "copy": {
-                                "name": "queue_roleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
-                              "properties": {
-                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "queue"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed queue."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed queue."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed queue."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
+                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                        "virtualNetwork": {
+                          "id": "[parameters('virtualNetworkResourceId')]"
                         }
                       },
                       "dependsOn": [
-                        "storageAccount"
+                        "privateDnsZone"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed virtual network link."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed virtual network link."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed virtual network link."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('virtualNetworkLink', '2020-06-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "privateDnsZone"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the private DNS zone was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the private DNS zone."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the private DNS zone."
+              },
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "managedIdentityHub",
+        "virtualNetwork"
+      ]
+    },
+    "defaultNetworkSecurityGroup": {
+      "condition": "[variables('createDefaultNsg')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-nsg', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[format('nsg-{0}', parameters('name'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "securityRules": {
+            "value": [
+              {
+                "name": "DenySshRdpOutbound",
+                "properties": {
+                  "priority": 200,
+                  "access": "Deny",
+                  "protocol": "*",
+                  "direction": "Outbound",
+                  "sourceAddressPrefix": "VirtualNetwork",
+                  "sourcePortRange": "*",
+                  "destinationAddressPrefix": "*",
+                  "destinationPortRanges": [
+                    "3389",
+                    "22"
+                  ]
+                }
+              }
+            ]
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "2832086720057246360"
+            },
+            "name": "Network Security Groups",
+            "description": "This module deploys a Network security Group (NSG).",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
+                  },
+                  "logCategoriesAndGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                          }
+                        },
+                        "categoryGroup": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "securityRulesType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the security rule."
+                    }
+                  },
+                  "properties": {
+                    "type": "object",
+                    "properties": {
+                      "access": {
+                        "type": "string",
+                        "allowedValues": [
+                          "Allow",
+                          "Deny"
+                        ],
+                        "metadata": {
+                          "description": "Required. Whether network traffic is allowed or denied."
+                        }
+                      },
+                      "description": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The description of the security rule."
+                        }
+                      },
+                      "destinationAddressPrefix": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                        }
+                      },
+                      "destinationAddressPrefixes": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                        }
+                      },
+                      "destinationApplicationSecurityGroupResourceIds": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The resource IDs of the application security groups specified as destination."
+                        }
+                      },
+                      "destinationPortRange": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                        }
+                      },
+                      "destinationPortRanges": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The destination port ranges."
+                        }
+                      },
+                      "direction": {
+                        "type": "string",
+                        "allowedValues": [
+                          "Inbound",
+                          "Outbound"
+                        ],
+                        "metadata": {
+                          "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                        }
+                      },
+                      "priority": {
+                        "type": "int",
+                        "minValue": 100,
+                        "maxValue": 4096,
+                        "metadata": {
+                          "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                        }
+                      },
+                      "protocol": {
+                        "type": "string",
+                        "allowedValues": [
+                          "*",
+                          "Ah",
+                          "Esp",
+                          "Icmp",
+                          "Tcp",
+                          "Udp"
+                        ],
+                        "metadata": {
+                          "description": "Required. Network protocol this rule applies to."
+                        }
+                      },
+                      "sourceAddressPrefix": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                        }
+                      },
+                      "sourceAddressPrefixes": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The CIDR or source IP ranges."
+                        }
+                      },
+                      "sourceApplicationSecurityGroupResourceIds": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The resource IDs of the application security groups specified as source."
+                        }
+                      },
+                      "sourcePortRange": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                        }
+                      },
+                      "sourcePortRanges": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The source port ranges."
+                        }
+                      }
+                    },
+                    "metadata": {
+                      "description": "Required. The properties of the security rule."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Network Security Group."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "securityRules": {
+              "$ref": "#/definitions/securityRulesType",
+              "metadata": {
+                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+              }
+            },
+            "flushConnection": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the NSG resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "networkSecurityGroup": {
+              "type": "Microsoft.Network/networkSecurityGroups",
+              "apiVersion": "2023-11-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "securityRules",
+                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                    "input": {
+                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                      "properties": {
+                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                      }
+                    }
+                  }
+                ],
+                "flushConnection": "[parameters('flushConnection')]"
+              }
+            },
+            "networkSecurityGroup_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_diagnosticSettings": {
+              "copy": {
+                "name": "networkSecurityGroup_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            },
+            "networkSecurityGroup_roleAssignments": {
+              "copy": {
+                "name": "networkSecurityGroup_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "networkSecurityGroup"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the network security group was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the network security group."
+              },
+              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the network security group."
+              },
+              "value": "[parameters('name')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('networkSecurityGroup', '2023-11-01', 'full').location]"
+            }
+          }
+        }
+      }
+    },
+    "bastion": {
+      "condition": "[variables('createBastion')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-bastion-host', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'name'), format('bas-{0}', parameters('name')))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "skuName": {
+            "value": "[coalesce(tryGet(parameters('bastionConfiguration'), 'sku'), 'Standard')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "virtualNetworkResourceId": {
+            "value": "[resourceId('Microsoft.Network/virtualNetworks', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))))]"
+          },
+          "disableCopyPaste": {
+            "value": "[tryGet(parameters('bastionConfiguration'), 'disableCopyPaste')]"
+          },
+          "enableFileCopy": {
+            "value": "[tryGet(parameters('bastionConfiguration'), 'enableFileCopy')]"
+          },
+          "enableIpConnect": {
+            "value": "[tryGet(parameters('bastionConfiguration'), 'enableIpConnect')]"
+          },
+          "enableKerberos": {
+            "value": "[tryGet(parameters('bastionConfiguration'), 'enableKerberos')]"
+          },
+          "enableShareableLink": {
+            "value": "[tryGet(parameters('bastionConfiguration'), 'enableShareableLink')]"
+          },
+          "scaleUnits": {
+            "value": "[tryGet(parameters('bastionConfiguration'), 'scaleUnits')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "8529247583922540645"
+            },
+            "name": "Bastion Hosts",
+            "description": "This module deploys a Bastion Host.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
+                  },
+                  "logCategoriesAndGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                          }
+                        },
+                        "categoryGroup": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Azure Bastion resource."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "virtualNetworkResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Shared services Virtual Network resource Id."
+              }
+            },
+            "bastionSubnetPublicIpResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The Public IP resource ID to associate to the azureBastionSubnet. If empty, then the Public IP that is created as part of this module will be applied to the azureBastionSubnet."
+              }
+            },
+            "publicIPAddressObject": {
+              "type": "object",
+              "defaultValue": {
+                "name": "[format('{0}-pip', parameters('name'))]"
+              },
+              "metadata": {
+                "description": "Optional. Specifies the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Basic",
+              "allowedValues": [
+                "Basic",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. The SKU of this Bastion Host."
+              }
+            },
+            "disableCopyPaste": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Copy Paste."
+              }
+            },
+            "enableFileCopy": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable File Copy."
+              }
+            },
+            "enableIpConnect": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable IP Connect."
+              }
+            },
+            "enableKerberos": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Kerberos authentication."
+              }
+            },
+            "enableShareableLink": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Choose to disable or enable Shareable Link."
+              }
+            },
+            "scaleUnits": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "Optional. The scale units for the Bastion Host resource."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-bastionhost.{0}.{1}', replace('0.2.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "azureBastion": {
+              "type": "Microsoft.Network/bastionHosts",
+              "apiVersion": "2022-11-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              },
+              "properties": "[union(createObject('scaleUnits', if(equals(parameters('skuName'), 'Basic'), 2, parameters('scaleUnits')), 'ipConfigurations', createArray(createObject('name', 'IpConfAzureBastionSubnet', 'properties', union(createObject('subnet', createObject('id', format('{0}/subnets/AzureBastionSubnet', parameters('virtualNetworkResourceId')))), createObject('publicIPAddress', createObject('id', if(not(empty(parameters('bastionSubnetPublicIpResourceId'))), parameters('bastionSubnetPublicIpResourceId'), reference('publicIPAddress').outputs.resourceId.value)))))), 'enableKerberos', parameters('enableKerberos')), if(equals(parameters('skuName'), 'Standard'), createObject('enableTunneling', equals(parameters('skuName'), 'Standard'), 'disableCopyPaste', parameters('disableCopyPaste'), 'enableFileCopy', parameters('enableFileCopy'), 'enableIpConnect', parameters('enableIpConnect'), 'enableShareableLink', parameters('enableShareableLink')), createObject()))]",
+              "dependsOn": [
+                "publicIPAddress"
+              ]
+            },
+            "azureBastion_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "azureBastion"
+              ]
+            },
+            "azureBastion_diagnosticSettings": {
+              "copy": {
+                "name": "azureBastion_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "azureBastion"
+              ]
+            },
+            "azureBastion_roleAssignments": {
+              "copy": {
+                "name": "azureBastion_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Network/bastionHosts', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "azureBastion"
+              ]
+            },
+            "publicIPAddress": {
+              "condition": "[empty(parameters('bastionSubnetPublicIpResourceId'))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Bastion-PIP', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('publicIPAddressObject').name]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "lock": {
+                    "value": "[parameters('lock')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'diagnosticSettings')]"
+                  },
+                  "publicIPAddressVersion": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAddressVersion')]"
+                  },
+                  "publicIPAllocationMethod": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAllocationMethod')]"
+                  },
+                  "publicIpPrefixResourceId": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPPrefixResourceId')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'roleAssignments')]"
+                  },
+                  "skuName": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuName')]"
+                  },
+                  "skuTier": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuTier')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'tags'), parameters('tags'))]"
+                  },
+                  "zones": {
+                    "value": "[tryGet(parameters('publicIPAddressObject'), 'zones')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.26.54.24096",
+                      "templateHash": "4718335757080871925"
+                    },
+                    "name": "Public IP Addresses",
+                    "description": "This module deploys a Public IP Address.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "dnsSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "domainNameLabel": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                          }
+                        },
+                        "domainNameLabelScope": {
+                          "type": "string",
+                          "allowedValues": [
+                            "",
+                            "NoReuse",
+                            "ResourceGroupReuse",
+                            "SubscriptionReuse",
+                            "TenantReuse"
+                          ],
+                          "metadata": {
+                            "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                          }
+                        },
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                          }
+                        },
+                        "reverseFqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                          }
+                        }
+                      }
+                    },
+                    "ddosSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "ddosProtectionPlan": {
+                          "type": "object",
+                          "properties": {
+                            "id": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The DDoS protection plan associated with the public IP address."
+                          }
+                        },
+                        "protectionMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. The DDoS protection policy customizations."
+                          }
+                        }
+                      }
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Public IP Address."
+                      }
+                    },
+                    "publicIpPrefixResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                      }
+                    },
+                    "publicIPAllocationMethod": {
+                      "type": "string",
+                      "defaultValue": "Static",
+                      "allowedValues": [
+                        "Dynamic",
+                        "Static"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The public IP address allocation method."
+                      }
+                    },
+                    "zones": {
+                      "type": "array",
+                      "items": {
+                        "type": "int"
+                      },
+                      "defaultValue": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "allowedValues": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "metadata": {
+                        "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                      }
+                    },
+                    "publicIPAddressVersion": {
+                      "type": "string",
+                      "defaultValue": "IPv4",
+                      "allowedValues": [
+                        "IPv4",
+                        "IPv6"
+                      ],
+                      "metadata": {
+                        "description": "Optional. IP address version."
+                      }
+                    },
+                    "dnsSettings": {
+                      "$ref": "#/definitions/dnsSettingsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The DNS settings of the public IP address."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Basic",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Name of a public IP address SKU."
+                      }
+                    },
+                    "skuTier": {
+                      "type": "string",
+                      "defaultValue": "Regional",
+                      "allowedValues": [
+                        "Global",
+                        "Regional"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Tier of a public IP address SKU."
+                      }
+                    },
+                    "ddosSettings": {
+                      "$ref": "#/definitions/ddosSettingsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "idleTimeoutInMinutes": {
+                      "type": "int",
+                      "defaultValue": 4,
+                      "metadata": {
+                        "description": "Optional. The idle timeout of the public IP address."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "publicIpAddress": {
+                      "type": "Microsoft.Network/publicIPAddresses",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "tier": "[parameters('skuTier')]"
+                      },
+                      "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                      "properties": {
+                        "ddosSettings": "[parameters('ddosSettings')]",
+                        "dnsSettings": "[parameters('dnsSettings')]",
+                        "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                        "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                        "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                        "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                        "ipTags": null
+                      }
+                    },
+                    "publicIpAddress_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    },
+                    "publicIpAddress_roleAssignments": {
+                      "copy": {
+                        "name": "publicIpAddress_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    },
+                    "publicIpAddress_diagnosticSettings": {
+                      "copy": {
+                        "name": "publicIpAddress_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "publicIpAddress"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the public IP address was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the public IP address."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the public IP address."
+                      },
+                      "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                    },
+                    "ipAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The public IP address of the public IP address resource."
+                      },
+                      "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the Azure Bastion was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name the Azure Bastion."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID the Azure Bastion."
+              },
+              "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('azureBastion', '2022-11-01', 'full').location]"
+            },
+            "ipConfAzureBastionSubnet": {
+              "type": "object",
+              "metadata": {
+                "description": "The Public IPconfiguration object for the AzureBastionSubnet."
+              },
+              "value": "[reference('azureBastion').ipConfigurations[0]]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork"
+      ]
+    },
+    "virtualMachine": {
+      "condition": "[variables('createVirtualMachine')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-virtual-machine', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'name'), format('vm-{0}', parameters('name')))]"
+          },
+          "computerName": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'name'), take(format('vm-{0}', parameters('name')), 15))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "adminUsername": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'adminUsername'), '')]"
+          },
+          "adminPassword": {
+            "value": "[tryGet(parameters('virtualMachineConfiguration'), 'adminPassword')]"
+          },
+          "nicConfigurations": {
+            "value": [
+              {
+                "name": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'nicConfigurationConfiguration', 'name'), format('nic-vm-{0}', parameters('name')))]",
+                "location": "[parameters('location')]",
+                "networkSecurityGroupResourceId": "[tryGet(parameters('virtualMachineConfiguration'), 'nicConfigurationConfiguration', 'networkSecurityGroupResourceId')]",
+                "ipConfigurations": [
+                  {
+                    "name": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'nicConfigurationConfiguration', 'ipConfigName'), format('nic-vm-{0}-ipconfig', parameters('name')))]",
+                    "privateIPAllocationMethod": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'nicConfigurationConfiguration', 'privateIPAllocationMethod'), 'Dynamic')]",
+                    "subnetResourceId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))), coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'name'), 'default'))]"
+                  }
+                ]
+              }
+            ]
+          },
+          "imageReference": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'imageReference'), createObject('publisher', 'microsoft-dsvm', 'offer', 'dsvm-win-2022', 'sku', 'winserver-2022', 'version', 'latest'))]"
+          },
+          "osDisk": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'osDisk'), createObject('createOption', 'FromImage', 'managedDisk', createObject('storageAccountType', 'Premium_ZRS'), 'diskSizeGB', 128, 'caching', 'ReadWrite'))]"
+          },
+          "patchMode": {
+            "value": "[tryGet(parameters('virtualMachineConfiguration'), 'patchMode')]"
+          },
+          "osType": {
+            "value": "Windows"
+          },
+          "encryptionAtHost": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'encryptionAtHost'), true())]"
+          },
+          "vmSize": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'size'), 'Standard_D2s_v3')]"
+          },
+          "zone": {
+            "value": "[coalesce(tryGet(parameters('virtualMachineConfiguration'), 'zone'), 0)]"
+          },
+          "extensionAadJoinConfig": "[if(equals(tryGet(parameters('virtualMachineConfiguration'), 'enableAadLoginExtension'), true()), createObject('value', createObject('enabled', true(), 'typeHandlerVersion', '1.0')), createObject('value', null()))]",
+          "extensionMonitoringAgentConfig": "[if(equals(tryGet(parameters('virtualMachineConfiguration'), 'enableAzureMonitorAgent'), true()), createObject('value', createObject('enabled', true())), createObject('value', null()))]",
+          "maintenanceConfigurationResourceId": {
+            "value": "[tryGet(parameters('virtualMachineConfiguration'), 'maintenanceConfigurationResourceId')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "2039205284269766938"
+            },
+            "name": "Virtual Machines",
+            "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "osDiskType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The disk name."
+                  }
+                },
+                "diskSizeGB": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the size of an empty data disk in gigabytes."
+                  }
+                },
+                "createOption": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Attach",
+                    "Empty",
+                    "FromImage"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies how the virtual machine should be created."
+                  }
+                },
+                "deleteOption": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Delete",
+                    "Detach"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                  }
+                },
+                "caching": {
+                  "type": "string",
+                  "allowedValues": [
+                    "None",
+                    "ReadOnly",
+                    "ReadWrite"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the caching requirements."
+                  }
+                },
+                "managedDisk": {
+                  "type": "object",
+                  "properties": {
+                    "storageAccountType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "PremiumV2_LRS",
+                        "Premium_LRS",
+                        "Premium_ZRS",
+                        "StandardSSD_LRS",
+                        "StandardSSD_ZRS",
+                        "Standard_LRS",
+                        "UltraSSD_LRS"
+                      ],
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the storage account type for the managed disk."
+                      }
+                    },
+                    "diskEncryptionSetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The managed disk parameters."
+                  }
+                }
+              }
+            },
+            "dataDisksType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The disk name."
+                    }
+                  },
+                  "lun": {
+                    "type": "int",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specifies the logical unit number of the data disk."
+                    }
+                  },
+                  "diskSizeGB": {
+                    "type": "int",
+                    "metadata": {
+                      "description": "Required. Specifies the size of an empty data disk in gigabytes."
+                    }
+                  },
+                  "createOption": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Attach",
+                      "Empty",
+                      "FromImage"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specifies how the virtual machine should be created."
+                    }
+                  },
+                  "deleteOption": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Delete",
+                      "Detach"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                    }
+                  },
+                  "caching": {
+                    "type": "string",
+                    "allowedValues": [
+                      "None",
+                      "ReadOnly",
+                      "ReadWrite"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specifies the caching requirements."
+                    }
+                  },
+                  "managedDisk": {
+                    "type": "object",
+                    "properties": {
+                      "storageAccountType": {
+                        "type": "string",
+                        "allowedValues": [
+                          "PremiumV2_LRS",
+                          "Premium_LRS",
+                          "Premium_ZRS",
+                          "StandardSSD_LRS",
+                          "StandardSSD_ZRS",
+                          "Standard_LRS",
+                          "UltraSSD_LRS"
+                        ],
+                        "metadata": {
+                          "description": "Required. Specifies the storage account type for the managed disk."
+                        }
+                      },
+                      "diskEncryptionSetResourceId": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                        }
+                      }
+                    },
+                    "metadata": {
+                      "description": "Required. The managed disk parameters."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
+              }
+            },
+            "computerName": {
+              "type": "string",
+              "defaultValue": "[parameters('name')]",
+              "metadata": {
+                "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
+              }
+            },
+            "vmSize": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Specifies the size for the VMs."
+              }
+            },
+            "encryptionAtHost": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+              }
+            },
+            "securityType": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings."
+              }
+            },
+            "secureBootEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
+              }
+            },
+            "vTpmEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
+              }
+            },
+            "imageReference": {
+              "type": "object",
+              "metadata": {
+                "description": "Required. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image."
+              }
+            },
+            "plan": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
+              }
+            },
+            "osDisk": {
+              "$ref": "#/definitions/osDiskType",
+              "metadata": {
+                "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+              }
+            },
+            "dataDisks": {
+              "$ref": "#/definitions/dataDisksType",
+              "metadata": {
+                "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+              }
+            },
+            "ultraSSDEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
+              }
+            },
+            "adminUsername": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Required. Administrator username."
+              }
+            },
+            "adminPassword": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. When specifying a Windows Virtual Machine, this value should be passed."
+              }
+            },
+            "customData": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
+              }
+            },
+            "certificatesToBeInstalled": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
+              }
+            },
+            "priority": {
+              "type": "string",
+              "defaultValue": "Regular",
+              "allowedValues": [
+                "Regular",
+                "Low",
+                "Spot"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the priority for the virtual machine."
+              }
+            },
+            "enableEvictionPolicy": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies the eviction policy for the low priority virtual machine. Will result in 'Deallocate' eviction policy."
+              }
+            },
+            "maxPriceForLowPriorityVm": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
+              }
+            },
+            "dedicatedHostId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
+              }
+            },
+            "licenseType": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "RHEL_BYOS",
+                "SLES_BYOS",
+                "Windows_Client",
+                "Windows_Server",
+                ""
+              ],
+              "metadata": {
+                "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
+              }
+            },
+            "publicKeys": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
+              }
+            },
+            "bootDiagnostics": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
+              }
+            },
+            "bootDiagnosticStorageAccountName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
+              }
+            },
+            "bootDiagnosticStorageAccountUri": {
+              "type": "string",
+              "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
+              "metadata": {
+                "description": "Optional. Storage account boot diagnostic base URI."
+              }
+            },
+            "proximityPlacementGroupResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of a proximity placement group."
+              }
+            },
+            "virtualMachineScaleSetResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
+              }
+            },
+            "availabilitySetResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
+              }
+            },
+            "galleryApplications": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
+              }
+            },
+            "zone": {
+              "type": "int",
+              "allowedValues": [
+                0,
+                1,
+                2,
+                3
+              ],
+              "metadata": {
+                "description": "Required. If set to 1, 2 or 3, the availability zone for all VMs is hardcoded to that value. If zero, then availability zones is not used. Cannot be used in combination with availability set nor scale set."
+              }
+            },
+            "nicConfigurations": {
+              "type": "array",
+              "metadata": {
+                "description": "Required. Configures NICs and PIPs."
+              }
+            },
+            "backupVaultName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Recovery service vault name to add VMs to backup."
+              }
+            },
+            "backupVaultResourceGroup": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().name]",
+              "metadata": {
+                "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
+              }
+            },
+            "backupPolicyName": {
+              "type": "string",
+              "defaultValue": "DefaultPolicy",
+              "metadata": {
+                "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
+              }
+            },
+            "autoShutdownConfig": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The configuration for auto-shutdown."
+              }
+            },
+            "maintenanceConfigurationResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The resource Id of a maintenance configuration for this VM."
+              }
+            },
+            "allowExtensionOperations": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
+              }
+            },
+            "extensionDomainJoinPassword": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
+              }
+            },
+            "extensionDomainJoinConfig": {
+              "type": "secureObject",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionAadJoinConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
+              }
+            },
+            "extensionAntiMalwareConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionMonitoringAgentConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionDependencyAgentConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionNetworkWatcherAgentConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionAzureDiskEncryptionConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
+              }
+            },
+            "extensionDSCConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionCustomScriptConfig": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false,
+                "fileData": []
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Custom Script] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionNvidiaGpuDriverWindows": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
+              }
+            },
+            "extensionHostPoolRegistration": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+              }
+            },
+            "extensionGuestConfigurationExtension": {
+              "type": "object",
+              "defaultValue": {
+                "enabled": false
+              },
+              "metadata": {
+                "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identy."
+              }
+            },
+            "guestConfiguration": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
+              }
+            },
+            "extensionCustomScriptProtectedSetting": {
+              "type": "secureObject",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. An object that contains the extension specific protected settings."
+              }
+            },
+            "extensionGuestConfigurationExtensionProtectedSettings": {
+              "type": "secureObject",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. An object that contains the extension specific protected settings."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "baseTime": {
+              "type": "string",
+              "defaultValue": "[utcNow('u')]",
+              "metadata": {
+                "description": "Generated. Do not provide a value! This date value is used to generate a registration token."
+              }
+            },
+            "sasTokenValidityLength": {
+              "type": "string",
+              "defaultValue": "PT8H",
+              "metadata": {
+                "description": "Optional. SAS token validity length to use to download files from storage accounts. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours."
+              }
+            },
+            "osType": {
+              "type": "string",
+              "allowedValues": [
+                "Windows",
+                "Linux"
+              ],
+              "metadata": {
+                "description": "Required. The chosen OS type."
+              }
+            },
+            "disablePasswordAuthentication": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Specifies whether password authentication should be disabled."
+              }
+            },
+            "provisionVMAgent": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
+              }
+            },
+            "enableAutomaticUpdates": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
+              }
+            },
+            "patchMode": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "AutomaticByPlatform",
+                "AutomaticByOS",
+                "Manual",
+                "ImageDefault",
+                ""
+              ],
+              "metadata": {
+                "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+              }
+            },
+            "bypassPlatformSafetyChecksOnUserSchedule": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enables customer to schedule patching without accidental upgrades."
+              }
+            },
+            "rebootSetting": {
+              "type": "string",
+              "defaultValue": "IfRequired",
+              "allowedValues": [
+                "Always",
+                "IfRequired",
+                "Never",
+                "Unknown"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
+              }
+            },
+            "patchAssessmentMode": {
+              "type": "string",
+              "defaultValue": "ImageDefault",
+              "allowedValues": [
+                "AutomaticByPlatform",
+                "ImageDefault"
+              ],
+              "metadata": {
+                "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
+              }
+            },
+            "timeZone": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
+              }
+            },
+            "additionalUnattendContent": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
+              }
+            },
+            "winRM": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell. - WinRMConfiguration object."
+              }
+            },
+            "configurationProfile": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "publicKeysFormatted",
+                "count": "[length(parameters('publicKeys'))]",
+                "input": {
+                  "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
+                  "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
+                }
+              }
+            ],
+            "linuxConfiguration": {
+              "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
+              "ssh": {
+                "publicKeys": "[variables('publicKeysFormatted')]"
+              },
+              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
+            },
+            "windowsConfiguration": {
+              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+              "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
+              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+              "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
+              "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), parameters('additionalUnattendContent'))]",
+              "winRM": "[if(not(empty(parameters('winRM'))), createObject('listeners', parameters('winRM')), null())]"
+            },
+            "accountSasProperties": {
+              "signedServices": "b",
+              "signedPermission": "r",
+              "signedExpiry": "[dateTimeAdd(parameters('baseTime'), parameters('sasTokenValidityLength'))]",
+              "signedResourceTypes": "o",
+              "signedProtocol": "https"
+            },
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
+              "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
+              "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
+              "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
+              "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
+              "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
+              "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
+              "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
+              "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+              "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
+              "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
+              "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
+              "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.5.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "vm": {
+              "type": "Microsoft.Compute/virtualMachines",
+              "apiVersion": "2023-09-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "identity": "[variables('identity')]",
+              "tags": "[parameters('tags')]",
+              "zones": "[if(not(equals(parameters('zone'), 0)), array(string(parameters('zone'))), null())]",
+              "plan": "[if(not(empty(parameters('plan'))), parameters('plan'), null())]",
+              "properties": {
+                "hardwareProfile": {
+                  "vmSize": "[parameters('vmSize')]"
+                },
+                "securityProfile": {
+                  "encryptionAtHost": "[if(parameters('encryptionAtHost'), parameters('encryptionAtHost'), null())]",
+                  "securityType": "[parameters('securityType')]",
+                  "uefiSettings": "[if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null())]"
+                },
+                "storageProfile": {
+                  "copy": [
+                    {
+                      "name": "dataDisks",
+                      "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
+                      "input": {
+                        "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
+                        "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))]",
+                        "diskSizeGB": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].diskSizeGB]",
+                        "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createoption'), 'Empty')]",
+                        "deleteOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete')]",
+                        "caching": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly')]",
+                        "managedDisk": {
+                          "storageAccountType": "[coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.storageAccountType]",
+                          "diskEncryptionSet": {
+                            "id": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId')]"
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "imageReference": "[parameters('imageReference')]",
+                  "osDisk": {
+                    "name": "[coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name')))]",
+                    "createOption": "[coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage')]",
+                    "deleteOption": "[coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete')]",
+                    "diskSizeGB": "[parameters('osDisk').diskSizeGB]",
+                    "caching": "[coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly')]",
+                    "managedDisk": {
+                      "storageAccountType": "[parameters('osDisk').managedDisk.storageAccountType]",
+                      "diskEncryptionSet": {
+                        "id": "[tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')]"
+                      }
+                    }
+                  }
+                },
+                "additionalCapabilities": {
+                  "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]"
+                },
+                "osProfile": {
+                  "computerName": "[parameters('computerName')]",
+                  "adminUsername": "[parameters('adminUsername')]",
+                  "adminPassword": "[parameters('adminPassword')]",
+                  "customData": "[if(not(empty(parameters('customData'))), base64(parameters('customData')), null())]",
+                  "windowsConfiguration": "[if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null())]",
+                  "linuxConfiguration": "[if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null())]",
+                  "secrets": "[parameters('certificatesToBeInstalled')]",
+                  "allowExtensionOperations": "[parameters('allowExtensionOperations')]"
+                },
+                "networkProfile": {
+                  "copy": [
+                    {
+                      "name": "networkInterfaces",
+                      "count": "[length(parameters('nicConfigurations'))]",
+                      "input": {
+                        "properties": {
+                          "deleteOption": "[if(contains(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].deleteOption, 'Delete')]",
+                          "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
+                        },
+                        "id": "[resourceId('Microsoft.Network/networkInterfaces', if(contains(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].name, format('{0}{1}', parameters('name'), parameters('nicConfigurations')[copyIndex('networkInterfaces')].nicSuffix)))]"
+                      }
+                    }
+                  ]
+                },
+                "diagnosticsProfile": {
+                  "bootDiagnostics": {
+                    "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
+                    "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
+                  }
+                },
+                "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
+                "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
+                "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
+                "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
+                "priority": "[parameters('priority')]",
+                "evictionPolicy": "[if(parameters('enableEvictionPolicy'), 'Deallocate', null())]",
+                "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
+                "host": "[if(not(empty(parameters('dedicatedHostId'))), createObject('id', parameters('dedicatedHostId')), null())]",
+                "licenseType": "[if(not(empty(parameters('licenseType'))), parameters('licenseType'), null())]"
+              },
+              "dependsOn": [
+                "vm_nic"
+              ]
+            },
+            "vm_configurationAssignment": {
+              "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
+              "type": "Microsoft.Maintenance/configurationAssignments",
+              "apiVersion": "2023-04-01",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[format('{0}assignment', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "properties": {
+                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
+                "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_configurationProfileAssignment": {
+              "condition": "[not(empty(parameters('configurationProfile')))]",
+              "type": "Microsoft.Automanage/configurationProfileAssignments",
+              "apiVersion": "2022-05-04",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "default",
+              "properties": {
+                "configurationProfile": "[parameters('configurationProfile')]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_autoShutdownConfiguration": {
+              "condition": "[not(empty(parameters('autoShutdownConfig')))]",
+              "type": "Microsoft.DevTestLab/schedules",
+              "apiVersion": "2018-09-15",
+              "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
+              "location": "[parameters('location')]",
+              "properties": {
+                "status": "[if(contains(parameters('autoShutdownConfig'), 'status'), parameters('autoShutdownConfig').status, 'Disabled')]",
+                "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                "taskType": "ComputeVmShutdownTask",
+                "dailyRecurrence": {
+                  "time": "[if(contains(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), parameters('autoShutdownConfig').dailyRecurrenceTime, '19:00')]"
+                },
+                "timeZoneId": "[if(contains(parameters('autoShutdownConfig'), 'timeZone'), parameters('autoShutdownConfig').timeZone, 'UTC')]",
+                "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), createObject('status', if(contains(parameters('autoShutdownConfig'), 'notificationStatus'), parameters('autoShutdownConfig').notificationStatus, 'Disabled'), 'emailRecipient', if(contains(parameters('autoShutdownConfig'), 'notificationEmail'), parameters('autoShutdownConfig').notificationEmail, ''), 'notificationLocale', if(contains(parameters('autoShutdownConfig'), 'notificationLocale'), parameters('autoShutdownConfig').notificationLocale, 'en'), 'webhookUrl', if(contains(parameters('autoShutdownConfig'), 'notificationWebhookUrl'), parameters('autoShutdownConfig').notificationWebhookUrl, ''), 'timeInMinutes', if(contains(parameters('autoShutdownConfig'), 'notificationTimeInMinutes'), parameters('autoShutdownConfig').notificationTimeInMinutes, 30)), null())]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_logAnalyticsWorkspace": {
+              "condition": "[not(empty(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId')))]",
+              "existing": true,
+              "type": "Microsoft.OperationalInsights/workspaces",
+              "apiVersion": "2021-06-01",
+              "subscriptionId": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2]]",
+              "resourceGroup": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]]",
+              "name": "[last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))]"
+            },
+            "AzureWindowsBaseline": {
+              "condition": "[not(empty(parameters('guestConfiguration')))]",
+              "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
+              "apiVersion": "2020-06-25",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "AzureWindowsBaseline",
+              "location": "[parameters('location')]",
+              "properties": {
+                "guestConfiguration": "[parameters('guestConfiguration')]"
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureGuestConfigurationExtension"
+              ]
+            },
+            "vm_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_roleAssignments": {
+              "copy": {
+                "name": "vm_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_nic": {
+              "copy": {
+                "name": "vm_nic",
+                "count": "[length(parameters('nicConfigurations'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "networkInterfaceName": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'name'), createObject('value', parameters('nicConfigurations')[copyIndex()].name), createObject('value', format('{0}{1}', parameters('name'), parameters('nicConfigurations')[copyIndex()].nicSuffix)))]",
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "enableIPForwarding": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), createObject('value', parameters('nicConfigurations')[copyIndex()].enableIPForwarding), createObject('value', false()))]",
+                  "enableAcceleratedNetworking": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), createObject('value', parameters('nicConfigurations')[copyIndex()].enableAcceleratedNetworking), createObject('value', true()))]",
+                  "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(parameters('nicConfigurations')[copyIndex()].dnsServers)), createObject('value', parameters('nicConfigurations')[copyIndex()].dnsServers), createObject('value', createArray())), createObject('value', createArray()))]",
+                  "networkSecurityGroupResourceId": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), createObject('value', parameters('nicConfigurations')[copyIndex()].networkSecurityGroupResourceId), createObject('value', ''))]",
+                  "ipConfigurations": {
+                    "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "6185170122493883924"
+                    }
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "networkInterfaceName": {
+                      "type": "string"
+                    },
+                    "virtualMachineName": {
+                      "type": "string"
+                    },
+                    "ipConfigurations": {
+                      "type": "array"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableIPForwarding": {
+                      "type": "bool",
+                      "defaultValue": false
+                    },
+                    "enableAcceleratedNetworking": {
+                      "type": "bool",
+                      "defaultValue": false
+                    },
+                    "dnsServers": {
+                      "type": "array",
+                      "defaultValue": []
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
+                      }
+                    },
+                    "networkSecurityGroupResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The network security group (NSG) to attach to the network interface."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the Network Interface."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "networkInterface_publicIPAddresses": {
+                      "copy": {
+                        "name": "networkInterface_publicIPAddresses",
+                        "count": "[length(parameters('ipConfigurations'))]"
+                      },
+                      "condition": "[contains(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'name'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.name), createObject('value', format('{0}{1}', parameters('virtualMachineName'), parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIpNameSuffix)))]",
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          },
+                          "idleTimeoutInMinutes": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'idleTimeoutInMinutes')]"
+                          },
+                          "ddosSettings": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'ddosSettings')]"
+                          },
+                          "dnsSettings": {
+                            "value": "[tryGet(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'dnsSettings')]"
+                          },
+                          "publicIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAddressVersion'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPAddressVersion), createObject('value', 'IPv4'))]",
+                          "publicIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPAllocationMethod'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPAllocationMethod), createObject('value', 'Static'))]",
+                          "publicIpPrefixResourceId": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'publicIPPrefixResourceId'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.publicIPPrefixResourceId), createObject('value', ''))]",
+                          "roleAssignments": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'roleAssignments'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.roleAssignments), createObject('value', createArray()))]",
+                          "skuName": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuName'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.skuName), createObject('value', 'Standard'))]",
+                          "skuTier": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'skuTier'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.skuTier), createObject('value', 'Regional'))]",
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "zones": "[if(contains(parameters('ipConfigurations')[copyIndex()].pipConfiguration, 'zones'), createObject('value', parameters('ipConfigurations')[copyIndex()].pipConfiguration.zones), createObject('value', createArray(1, 2, 3)))]",
+                          "enableTelemetry": {
+                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.27.1.19265",
+                              "templateHash": "10356333973104369631"
+                            },
+                            "name": "Public IP Addresses",
+                            "description": "This module deploys a Public IP Address.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "dnsSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "domainNameLabel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                  }
+                                },
+                                "domainNameLabelScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "",
+                                    "NoReuse",
+                                    "ResourceGroupReuse",
+                                    "SubscriptionReuse",
+                                    "TenantReuse"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                  }
+                                },
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                  }
+                                },
+                                "reverseFqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                  }
+                                }
+                              }
+                            },
+                            "ddosSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "ddosProtectionPlan": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                  }
+                                },
+                                "protectionMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The DDoS protection policy customizations."
+                                  }
+                                }
+                              }
+                            },
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "metricCategories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Public IP Address."
+                              }
+                            },
+                            "publicIpPrefixResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                              }
+                            },
+                            "publicIPAllocationMethod": {
+                              "type": "string",
+                              "defaultValue": "Static",
+                              "allowedValues": [
+                                "Dynamic",
+                                "Static"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The public IP address allocation method."
+                              }
+                            },
+                            "zones": {
+                              "type": "array",
+                              "items": {
+                                "type": "int"
+                              },
+                              "defaultValue": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "allowedValues": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                              }
+                            },
+                            "publicIPAddressVersion": {
+                              "type": "string",
+                              "defaultValue": "IPv4",
+                              "allowedValues": [
+                                "IPv4",
+                                "IPv6"
+                              ],
+                              "metadata": {
+                                "description": "Optional. IP address version."
+                              }
+                            },
+                            "dnsSettings": {
+                              "$ref": "#/definitions/dnsSettingsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The DNS settings of the public IP address."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "Standard",
+                              "allowedValues": [
+                                "Basic",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Name of a public IP address SKU."
+                              }
+                            },
+                            "skuTier": {
+                              "type": "string",
+                              "defaultValue": "Regional",
+                              "allowedValues": [
+                                "Global",
+                                "Regional"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Tier of a public IP address SKU."
+                              }
+                            },
+                            "ddosSettings": {
+                              "$ref": "#/definitions/ddosSettingsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "idleTimeoutInMinutes": {
+                              "type": "int",
+                              "defaultValue": 4,
+                              "metadata": {
+                                "description": "Optional. The idle timeout of the public IP address."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "publicIpAddress": {
+                              "type": "Microsoft.Network/publicIPAddresses",
+                              "apiVersion": "2023-09-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('skuName')]",
+                                "tier": "[parameters('skuTier')]"
+                              },
+                              "zones": "[map(parameters('zones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                              "properties": {
+                                "ddosSettings": "[parameters('ddosSettings')]",
+                                "dnsSettings": "[parameters('dnsSettings')]",
+                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                "ipTags": null
+                              }
+                            },
+                            "publicIpAddress_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            },
+                            "publicIpAddress_roleAssignments": {
+                              "copy": {
+                                "name": "publicIpAddress_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            },
+                            "publicIpAddress_diagnosticSettings": {
+                              "copy": {
+                                "name": "publicIpAddress_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the public IP address was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the public IP address."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the public IP address."
+                              },
+                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                            },
+                            "ipAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The public IP address of the public IP address resource."
+                              },
+                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('publicIpAddress', '2023-09-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "networkInterface": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-NetworkInterface', deployment().name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('networkInterfaceName')]"
+                          },
+                          "ipConfigurations": {
+                            "copy": [
+                              {
+                                "name": "value",
+                                "count": "[length(parameters('ipConfigurations'))]",
+                                "input": "[createObject('name', if(not(empty(parameters('ipConfigurations')[copyIndex('value')].name)), parameters('ipConfigurations')[copyIndex('value')].name, null()), 'primary', equals(copyIndex('value'), 0), 'privateIPAllocationMethod', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('value')].privateIPAllocationMethod, null()), null()), 'privateIPAddress', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('value')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('value')].privateIPAddress, null()), null()), 'publicIPAddressResourceId', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), resourceId('Microsoft.Network/publicIPAddresses', if(contains(parameters('ipConfigurations')[copyIndex('value')].pipConfiguration, 'name'), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.name, format('{0}{1}', parameters('virtualMachineName'), parameters('ipConfigurations')[copyIndex('value')].pipConfiguration.publicIpNameSuffix))), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('value')].loadBalancerBackendAddressPools, null()), 'applicationSecurityGroups', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('value')].applicationSecurityGroups, null()), 'applicationGatewayBackendAddressPools', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('value')].applicationGatewayBackendAddressPools, null()), 'gatewayLoadBalancer', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('value')].gatewayLoadBalancer, null()), 'loadBalancerInboundNatRules', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('value')].loadBalancerInboundNatRules, null()), 'privateIPAddressVersion', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('value')].privateIPAddressVersion, null()), 'virtualNetworkTaps', if(contains(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('value')].virtualNetworkTaps, null()))]"
+                              }
+                            ]
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[parameters('diagnosticSettings')]"
+                          },
+                          "dnsServers": "[if(not(empty(parameters('dnsServers'))), createObject('value', parameters('dnsServers')), createObject('value', createArray()))]",
+                          "enableAcceleratedNetworking": {
+                            "value": "[parameters('enableAcceleratedNetworking')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "enableIPForwarding": {
+                            "value": "[parameters('enableIPForwarding')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          },
+                          "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
+                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "1612343535299711142"
+                            },
+                            "name": "Network Interface",
+                            "description": "This module deploys a Network Interface.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "diagnosticSettingType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of diagnostic setting."
+                                    }
+                                  },
+                                  "logCategoriesAndGroups": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                          }
+                                        },
+                                        "categoryGroup": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                    }
+                                  },
+                                  "metricCategories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "category": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                    }
+                                  },
+                                  "logAnalyticsDestinationType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureDiagnostics",
+                                      "Dedicated"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                    }
+                                  },
+                                  "workspaceResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "storageAccountResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "eventHubAuthorizationRuleResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                    }
+                                  },
+                                  "eventHubName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                    }
+                                  },
+                                  "marketplacePartnerResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the network interface."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource tags."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "enableIPForwarding": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                              }
+                            },
+                            "enableAcceleratedNetworking": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If the network interface is accelerated networking enabled."
+                              }
+                            },
+                            "dnsServers": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                              }
+                            },
+                            "networkSecurityGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The network security group (NSG) to attach to the network interface."
+                              }
+                            },
+                            "auxiliaryMode": {
+                              "type": "string",
+                              "defaultValue": "None",
+                              "allowedValues": [
+                                "Floating",
+                                "MaxConnections",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                              }
+                            },
+                            "auxiliarySku": {
+                              "type": "string",
+                              "defaultValue": "None",
+                              "allowedValues": [
+                                "A1",
+                                "A2",
+                                "A4",
+                                "A8",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                              }
+                            },
+                            "disableTcpStateTracking": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. A list of IPConfigurations of the network interface."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "$ref": "#/definitions/diagnosticSettingType",
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.2.4', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "networkInterface": {
+                              "type": "Microsoft.Network/networkInterfaces",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "ipConfigurations",
+                                    "count": "[length(parameters('ipConfigurations'))]",
+                                    "input": {
+                                      "name": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].name, format('ipconfig0{0}', add(copyIndex('ipConfigurations'), 1)))]",
+                                      "properties": {
+                                        "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
+                                        "privateIPAllocationMethod": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAllocationMethod, null()), null())]",
+                                        "privateIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress'), if(not(empty(parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress)), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddress, null()), null())]",
+                                        "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId, null())), createObject('id', parameters('ipConfigurations')[copyIndex('ipConfigurations')].publicIPAddressResourceId), null()), null())]",
+                                        "subnet": {
+                                          "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
+                                        },
+                                        "loadBalancerBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerBackendAddressPools, null())]",
+                                        "applicationSecurityGroups": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationSecurityGroups, null())]",
+                                        "applicationGatewayBackendAddressPools": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].applicationGatewayBackendAddressPools, null())]",
+                                        "gatewayLoadBalancer": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].gatewayLoadBalancer, null())]",
+                                        "loadBalancerInboundNatRules": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].loadBalancerInboundNatRules, null())]",
+                                        "privateIPAddressVersion": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].privateIPAddressVersion, null())]",
+                                        "virtualNetworkTaps": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps'), parameters('ipConfigurations')[copyIndex('ipConfigurations')].virtualNetworkTaps, null())]"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "auxiliaryMode": "[parameters('auxiliaryMode')]",
+                                "auxiliarySku": "[parameters('auxiliarySku')]",
+                                "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
+                                "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
+                                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
+                                "enableIPForwarding": "[parameters('enableIPForwarding')]",
+                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
+                              }
+                            },
+                            "networkInterface_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "networkInterface"
+                              ]
+                            },
+                            "networkInterface_diagnosticSettings": {
+                              "copy": {
+                                "name": "networkInterface_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "networkInterface"
+                              ]
+                            },
+                            "networkInterface_roleAssignments": {
+                              "copy": {
+                                "name": "networkInterface_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "networkInterface"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed resource."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed resource."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed resource."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('networkInterface', '2023-04-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "networkInterface_publicIPAddresses"
+                      ]
+                    }
+                  }
+                }
+              }
+            },
+            "vm_aadJoinExtension": {
+              "condition": "[parameters('extensionAadJoinConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "AADLogin"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.ActiveDirectory"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
+                  "typeHandlerVersion": "[if(contains(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAadJoinConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '2.0'), createObject('value', '1.0')))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAadJoinConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAadJoinConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "settings": "[if(contains(parameters('extensionAadJoinConfig'), 'settings'), createObject('value', parameters('extensionAadJoinConfig').settings), createObject('value', createObject()))]",
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm"
+              ]
+            },
+            "vm_domainJoinExtension": {
+              "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "DomainJoin"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Compute"
+                  },
+                  "type": {
+                    "value": "JsonADDomainExtension"
+                  },
+                  "typeHandlerVersion": "[if(contains(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDomainJoinConfig').typeHandlerVersion), createObject('value', '1.3'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDomainJoinConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDomainJoinConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "settings": {
+                    "value": "[parameters('extensionDomainJoinConfig').settings]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": {
+                    "value": {
+                      "Password": "[parameters('extensionDomainJoinPassword')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_aadJoinExtension"
+              ]
+            },
+            "vm_microsoftAntiMalwareExtension": {
+              "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "MicrosoftAntiMalware"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Security"
+                  },
+                  "type": {
+                    "value": "IaaSAntimalware"
+                  },
+                  "typeHandlerVersion": "[if(contains(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAntiMalwareConfig').typeHandlerVersion), createObject('value', '1.3'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAntiMalwareConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAntiMalwareConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "settings": {
+                    "value": "[parameters('extensionAntiMalwareConfig').settings]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_domainJoinExtension"
+              ]
+            },
+            "vm_azureMonitorAgentExtension": {
+              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "AzureMonitorAgent"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Monitor"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
+                  "typeHandlerVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
+                  },
+                  "autoUpgradeMinorVersion": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                  },
+                  "enableAutomaticUpgrade": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                  },
+                  "settings": {
+                    "value": {
+                      "workspaceId": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), reference('vm_logAnalyticsWorkspace').customerId, '')]",
+                      "GCS_AUTO_CONFIG": "[if(equals(parameters('osType'), 'Linux'), true(), null())]"
+                    }
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": {
+                    "value": {
+                      "workspaceKey": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2], split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))), '2021-06-01').primarySharedKey, '')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_logAnalyticsWorkspace",
+                "vm_microsoftAntiMalwareExtension"
+              ]
+            },
+            "vm_dependencyAgentExtension": {
+              "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "DependencyAgent"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Monitoring.DependencyAgent"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
+                  "typeHandlerVersion": "[if(contains(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDependencyAgentConfig').typeHandlerVersion), createObject('value', '9.10'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDependencyAgentConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDependencyAgentConfig').enableAutomaticUpgrade), createObject('value', true()))]",
+                  "settings": {
+                    "value": {
+                      "enableAMA": "[if(contains(parameters('extensionDependencyAgentConfig'), 'enableAMA'), parameters('extensionDependencyAgentConfig').enableAMA, true())]"
+                    }
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureMonitorAgentExtension"
+              ]
+            },
+            "vm_networkWatcherAgentExtension": {
+              "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "NetworkWatcherAgent"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.NetworkWatcher"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
+                  "typeHandlerVersion": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').typeHandlerVersion), createObject('value', '1.4'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionNetworkWatcherAgentConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_dependencyAgentExtension"
+              ]
+            },
+            "vm_desiredStateConfigurationExtension": {
+              "condition": "[parameters('extensionDSCConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "DesiredStateConfiguration"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Powershell"
+                  },
+                  "type": {
+                    "value": "DSC"
+                  },
+                  "typeHandlerVersion": "[if(contains(parameters('extensionDSCConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionDSCConfig').typeHandlerVersion), createObject('value', '2.77'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionDSCConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionDSCConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "settings": "[if(contains(parameters('extensionDSCConfig'), 'settings'), createObject('value', parameters('extensionDSCConfig').settings), createObject('value', createObject()))]",
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": "[if(contains(parameters('extensionDSCConfig'), 'protectedSettings'), createObject('value', parameters('extensionDSCConfig').protectedSettings), createObject('value', createObject()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_networkWatcherAgentExtension"
+              ]
+            },
+            "vm_customScriptExtension": {
+              "condition": "[parameters('extensionCustomScriptConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "CustomScriptExtension"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
+                  "typeHandlerVersion": "[if(contains(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionCustomScriptConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '1.10'), createObject('value', '2.1')))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionCustomScriptConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionCustomScriptConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "settings": {
+                    "value": {
+                      "copy": [
+                        {
+                          "name": "fileUris",
+                          "count": "[length(parameters('extensionCustomScriptConfig').fileData)]",
+                          "input": "[if(contains(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')], 'storageAccountId'), format('{0}?{1}', parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri, listAccountSas(parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].storageAccountId, '2019-04-01', variables('accountSasProperties')).accountSasToken), parameters('extensionCustomScriptConfig').fileData[copyIndex('fileUris')].uri)]"
+                        }
+                      ]
+                    }
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
+                  },
+                  "protectedSettings": {
+                    "value": "[parameters('extensionCustomScriptProtectedSetting')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_desiredStateConfigurationExtension"
+              ]
+            },
+            "vm_azureDiskEncryptionExtension": {
+              "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "AzureDiskEncryption"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.Azure.Security"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
+                  "typeHandlerVersion": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '2.2'), createObject('value', '1.1')))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "forceUpdateTag": "[if(contains(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), createObject('value', parameters('extensionAzureDiskEncryptionConfig').forceUpdateTag), createObject('value', '1.0'))]",
+                  "settings": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
+                  },
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_customScriptExtension"
+              ]
+            },
+            "vm_nvidiaGpuDriverWindowsExtension": {
+              "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "NvidiaGpuDriverWindows"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.HpcCompute"
+                  },
+                  "type": {
+                    "value": "NvidiaGpuDriverWindows"
+                  },
+                  "typeHandlerVersion": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').typeHandlerVersion), createObject('value', '1.4'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionNvidiaGpuDriverWindows').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureDiskEncryptionExtension"
+              ]
+            },
+            "vm_hostPoolRegistrationExtension": {
+              "condition": "[parameters('extensionHostPoolRegistration').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "HostPoolRegistration"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.PowerShell"
+                  },
+                  "type": {
+                    "value": "DSC"
+                  },
+                  "typeHandlerVersion": "[if(contains(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), createObject('value', parameters('extensionHostPoolRegistration').typeHandlerVersion), createObject('value', '2.77'))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionHostPoolRegistration').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionHostPoolRegistration').enableAutomaticUpgrade), createObject('value', false()))]",
+                  "settings": {
+                    "value": {
+                      "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
+                      "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
+                      "properties": {
+                        "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
+                        "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]",
+                        "aadJoin": true
+                      },
+                      "supressFailures": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
+                    }
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_nvidiaGpuDriverWindowsExtension"
+              ]
+            },
+            "vm_azureGuestConfigurationExtension": {
+              "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "virtualMachineName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "publisher": {
+                    "value": "Microsoft.GuestConfiguration"
+                  },
+                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
+                  "typeHandlerVersion": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), createObject('value', parameters('extensionGuestConfigurationExtension').typeHandlerVersion), if(equals(parameters('osType'), 'Windows'), createObject('value', '1.0'), createObject('value', '1.0')))]",
+                  "autoUpgradeMinorVersion": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), createObject('value', parameters('extensionGuestConfigurationExtension').autoUpgradeMinorVersion), createObject('value', true()))]",
+                  "enableAutomaticUpgrade": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), createObject('value', parameters('extensionGuestConfigurationExtension').enableAutomaticUpgrade), createObject('value', true()))]",
+                  "forceUpdateTag": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), createObject('value', parameters('extensionGuestConfigurationExtension').forceUpdateTag), createObject('value', '1.0'))]",
+                  "settings": "[if(contains(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject('value', parameters('extensionGuestConfigurationExtension').settings), createObject('value', createObject()))]",
+                  "supressFailures": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
+                  },
+                  "protectedSettings": {
+                    "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "15287507275706455668"
+                    },
+                    "name": "Virtual Machine Extensions",
+                    "description": "This module deploys a Virtual Machine Extension.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "virtualMachineName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine extension."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location the extension is deployed to."
+                      }
+                    },
+                    "publisher": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the extension handler publisher."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                      }
+                    },
+                    "typeHandlerVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the version of the script handler."
+                      }
+                    },
+                    "autoUpgradeMinorVersion": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                      }
+                    },
+                    "forceUpdateTag": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                      }
+                    },
+                    "settings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific settings."
+                      }
+                    },
+                    "protectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Any object that contains the extension specific protected settings."
+                      }
+                    },
+                    "supressFailures": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                      }
+                    },
+                    "enableAutomaticUpgrade": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "existing": true,
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2022-11-01",
+                      "name": "[parameters('virtualMachineName')]"
+                    },
+                    "extension": {
+                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                      "apiVersion": "2022-11-01",
+                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "publisher": "[parameters('publisher')]",
+                        "type": "[parameters('type')]",
+                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                        "forceUpdateTag": "[if(not(empty(parameters('forceUpdateTag'))), parameters('forceUpdateTag'), null())]",
+                        "settings": "[if(not(empty(parameters('settings'))), parameters('settings'), null())]",
+                        "protectedSettings": "[if(not(empty(parameters('protectedSettings'))), parameters('protectedSettings'), null())]",
+                        "suppressFailures": "[parameters('supressFailures')]"
+                      },
+                      "dependsOn": [
+                        "virtualMachine"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the extension."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the extension."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the extension was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('extension', '2022-11-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_hostPoolRegistrationExtension"
+              ]
+            },
+            "vm_backup": {
+              "condition": "[not(empty(parameters('backupVaultName')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
+              "resourceGroup": "[parameters('backupVaultResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "policyId": {
+                    "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
+                  },
+                  "protectedItemType": {
+                    "value": "Microsoft.Compute/virtualMachines"
+                  },
+                  "protectionContainerName": {
+                    "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                  },
+                  "recoveryVaultName": {
+                    "value": "[parameters('backupVaultName')]"
+                  },
+                  "sourceResourceId": {
+                    "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "4311417160342913977"
+                    },
+                    "name": "Recovery Service Vaults Protection Container Protected Item",
+                    "description": "This module deploys a Recovery Services Vault Protection Container Protected Item.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the resource."
+                      }
+                    },
+                    "protectionContainerName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "recoveryVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "protectedItemType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "AzureFileShareProtectedItem",
+                        "AzureVmWorkloadSAPAseDatabase",
+                        "AzureVmWorkloadSAPHanaDatabase",
+                        "AzureVmWorkloadSQLDatabase",
+                        "DPMProtectedItem",
+                        "GenericProtectedItem",
+                        "MabFileFolderProtectedItem",
+                        "Microsoft.ClassicCompute/virtualMachines",
+                        "Microsoft.Compute/virtualMachines",
+                        "Microsoft.Sql/servers/databases"
+                      ],
+                      "metadata": {
+                        "description": "Required. The backup item type."
+                      }
+                    },
+                    "policyId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. ID of the backup policy with which this item is backed up."
+                      }
+                    },
+                    "sourceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the resource to back up."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
+                      "apiVersion": "2023-01-01",
+                      "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "protectedItemType": "[parameters('protectedItemType')]",
+                        "policyId": "[parameters('policyId')]",
+                        "sourceResourceId": "[parameters('sourceResourceId')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Resource Group the protected item was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the protected item."
+                      },
+                      "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Name of the protected item."
+                      },
+                      "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "vm",
+                "vm_azureGuestConfigurationExtension"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the VM."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the VM."
+              },
+              "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the resource group the VM was created in."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('vm', '2023-09-01', 'full'), 'identity'), 'principalId'), '')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('vm', '2023-09-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork::defaultSubnet"
+      ]
+    },
+    "keyVault": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-key-vault', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('keyVaultConfiguration'), 'name'), format('kv-{0}', parameters('name')))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "enableRbacAuthorization": {
+            "value": true
+          },
+          "enableVaultForDeployment": {
+            "value": false
+          },
+          "enableVaultForDiskEncryption": {
+            "value": false
+          },
+          "enableVaultForTemplateDeployment": {
+            "value": false
+          },
+          "networkAcls": {
+            "value": {
+              "defaultAction": "Deny",
+              "bypass": "AzureServices"
+            }
+          },
+          "publicNetworkAccess": {
+            "value": "Disabled"
+          },
+          "enablePurgeProtection": {
+            "value": "[coalesce(tryGet(parameters('keyVaultConfiguration'), 'enablePurgeProtection'), true())]"
+          },
+          "roleAssignments": {
+            "value": [
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Key Vault Administrator",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Key Vault Administrator",
+                "principalType": "ServicePrincipal"
+              }
+            ]
+          },
+          "diagnosticSettings": {
+            "value": [
+              {
+                "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', coalesce(tryGet(parameters('logAnalyticsConfiguration'), 'name'), format('log-{0}', parameters('name'))))]",
+                "logCategoriesAndGroups": [
+                  {
+                    "category": "AuditEvent",
+                    "enabled": true
+                  }
+                ]
+              }
+            ]
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "6639574961348492362"
+            },
+            "name": "Key Vaults",
+            "description": "This module deploys a Key Vault.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
+                  },
+                  "logCategoriesAndGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                          }
+                        },
+                        "categoryGroup": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "metricCategories": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                    }
+                  },
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "privateEndpointType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private endpoint."
+                    }
+                  },
+                  "location": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The location to deploy the private endpoint to."
+                    }
+                  },
+                  "privateLinkServiceConnectionName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private link connection to create."
+                    }
+                  },
+                  "service": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                    }
+                  },
+                  "subnetResourceId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                    }
+                  },
+                  "privateDnsZoneGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                    }
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                    }
+                  },
+                  "isManualConnection": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. If Manual Private Link Connection is required."
+                    }
+                  },
+                  "manualConnectionRequestMessage": {
+                    "type": "string",
+                    "nullable": true,
+                    "maxLength": 140,
+                    "metadata": {
+                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                    }
+                  },
+                  "customDnsConfigs": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Required. Fqdn that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Custom DNS configurations."
+                    }
+                  },
+                  "ipConfigurations": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                    }
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                    }
+                  },
+                  "customNetworkInterfaceName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                    }
+                  },
+                  "lock": {
+                    "$ref": "#/definitions/lockType",
+                    "metadata": {
+                      "description": "Optional. Specify the type of lock."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                    }
+                  },
+                  "enableTelemetry": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Enable/Disable usage telemetry for module."
+                    }
+                  },
+                  "resourceGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "accessPoliciesType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "tenantId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                    }
+                  },
+                  "objectId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                    }
+                  },
+                  "applicationId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Application ID of the client making request on behalf of a principal."
+                    }
+                  },
+                  "permissions": {
+                    "type": "object",
+                    "properties": {
+                      "keys": {
+                        "type": "array",
+                        "allowedValues": [
+                          "all",
+                          "backup",
+                          "create",
+                          "decrypt",
+                          "delete",
+                          "encrypt",
+                          "get",
+                          "getrotationpolicy",
+                          "import",
+                          "list",
+                          "purge",
+                          "recover",
+                          "release",
+                          "restore",
+                          "rotate",
+                          "setrotationpolicy",
+                          "sign",
+                          "unwrapKey",
+                          "update",
+                          "verify",
+                          "wrapKey"
+                        ],
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Permissions to keys."
+                        }
+                      },
+                      "secrets": {
+                        "type": "array",
+                        "allowedValues": [
+                          "all",
+                          "backup",
+                          "delete",
+                          "get",
+                          "list",
+                          "purge",
+                          "recover",
+                          "restore",
+                          "set"
+                        ],
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Permissions to secrets."
+                        }
+                      },
+                      "certificates": {
+                        "type": "array",
+                        "allowedValues": [
+                          "all",
+                          "backup",
+                          "create",
+                          "delete",
+                          "deleteissuers",
+                          "get",
+                          "getissuers",
+                          "import",
+                          "list",
+                          "listissuers",
+                          "managecontacts",
+                          "manageissuers",
+                          "purge",
+                          "recover",
+                          "restore",
+                          "setissuers",
+                          "update"
+                        ],
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Permissions to certificates."
+                        }
+                      },
+                      "storage": {
+                        "type": "array",
+                        "allowedValues": [
+                          "all",
+                          "backup",
+                          "delete",
+                          "deletesas",
+                          "get",
+                          "getsas",
+                          "list",
+                          "listsas",
+                          "purge",
+                          "recover",
+                          "regeneratekey",
+                          "restore",
+                          "set",
+                          "setsas",
+                          "update"
+                        ],
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Permissions to storage accounts."
+                        }
+                      }
+                    },
+                    "metadata": {
+                      "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "secretsType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the secret."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource tags."
+                    }
+                  },
+                  "attributes": {
+                    "type": "object",
+                    "properties": {
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Defines whether the secret is enabled or disabled."
+                        }
+                      },
+                      "exp": {
+                        "type": "int",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
+                        }
+                      },
+                      "nbf": {
+                        "type": "int",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Contains attributes of the secret."
+                    }
+                  },
+                  "contentType": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The content type of the secret."
+                    }
+                  },
+                  "value": {
+                    "type": "securestring",
+                    "metadata": {
+                      "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "keysType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The name of the key."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource tags."
+                    }
+                  },
+                  "attributes": {
+                    "type": "object",
+                    "properties": {
+                      "enabled": {
+                        "type": "bool",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Defines whether the key is enabled or disabled."
+                        }
+                      },
+                      "exp": {
+                        "type": "int",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
+                        }
+                      },
+                      "nbf": {
+                        "type": "int",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Contains attributes of the key."
+                    }
+                  },
+                  "curveName": {
+                    "type": "string",
+                    "allowedValues": [
+                      "P-256",
+                      "P-256K",
+                      "P-384",
+                      "P-521"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"."
+                    }
+                  },
+                  "keyOps": {
+                    "type": "array",
+                    "allowedValues": [
+                      "decrypt",
+                      "encrypt",
+                      "import",
+                      "release",
+                      "sign",
+                      "unwrapKey",
+                      "verify",
+                      "wrapKey"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The allowed operations on this key."
+                    }
+                  },
+                  "keySize": {
+                    "type": "int",
+                    "allowedValues": [
+                      2048,
+                      3072,
+                      4096
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"."
+                    }
+                  },
+                  "kty": {
+                    "type": "string",
+                    "allowedValues": [
+                      "EC",
+                      "EC-HSM",
+                      "RSA",
+                      "RSA-HSM"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The type of the key. Default is \"EC\"."
+                    }
+                  },
+                  "releasePolicy": {
+                    "type": "object",
+                    "properties": {
+                      "contentType": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Content type and version of key release policy."
+                        }
+                      },
+                      "data": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. Blob encoding the policy rules under which the key can be released."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Key release policy."
+                    }
+                  },
+                  "rotationPolicy": {
+                    "$ref": "#/definitions/rotationPoliciesType",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Key rotation policy."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "rotationPoliciesType": {
+              "type": "object",
+              "properties": {
+                "attributes": {
+                  "type": "object",
+                  "properties": {
+                    "expiryTime": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The attributes of key rotation policy."
+                  }
+                },
+                "lifetimeActions": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "action": {
+                        "type": "object",
+                        "properties": {
+                          "type": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Notify",
+                              "Rotate"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The type of action."
+                            }
+                          }
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The action of key rotation policy lifetimeAction."
+                        }
+                      },
+                      "trigger": {
+                        "type": "object",
+                        "properties": {
+                          "timeAfterCreate": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                            }
+                          },
+                          "timeBeforeExpiry": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                            }
+                          }
+                        },
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The trigger of key rotation policy lifetimeAction."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The lifetimeActions for key rotation action."
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "maxLength": 24,
+              "metadata": {
+                "description": "Required. Name of the Key Vault. Must be globally unique."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "accessPolicies": {
+              "$ref": "#/definitions/accessPoliciesType",
+              "metadata": {
+                "description": "Optional. All access policies to create."
+              }
+            },
+            "secrets": {
+              "$ref": "#/definitions/secretsType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. All secrets to create."
+              }
+            },
+            "keys": {
+              "$ref": "#/definitions/keysType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. All keys to create."
+              }
+            },
+            "enableVaultForDeployment": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Specifies if the vault is enabled for deployment by script or compute."
+              }
+            },
+            "enableVaultForTemplateDeployment": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Specifies if the vault is enabled for a template deployment."
+              }
+            },
+            "enableVaultForDiskEncryption": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios."
+              }
+            },
+            "enableSoftDelete": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Switch to enable/disable Key Vault's soft delete feature."
+              }
+            },
+            "softDeleteRetentionInDays": {
+              "type": "int",
+              "defaultValue": 90,
+              "metadata": {
+                "description": "Optional. softDelete data retention days. It accepts >=7 and <=90."
+              }
+            },
+            "enableRbacAuthorization": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC."
+              }
+            },
+            "createMode": {
+              "type": "string",
+              "defaultValue": "default",
+              "metadata": {
+                "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not. - recover or default."
+              }
+            },
+            "enablePurgeProtection": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature."
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "premium",
+              "allowedValues": [
+                "premium",
+                "standard"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the SKU for the vault."
+              }
+            },
+            "networkAcls": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Rules governing the accessibility of the resource from specific network locations."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "",
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "privateEndpoints": {
+              "$ref": "#/definitions/privateEndpointType",
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Resource tags."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedAccessPolicies",
+                "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
+                "input": {
+                  "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
+                  "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
+                  "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
+                  "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
+                }
+              }
+            ],
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+              "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
+              "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]",
+              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+              "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
+              "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
+              "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
+              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+              "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
+              "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.6.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "keyVault": {
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2022-07-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
+                "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]",
+                "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
+                "enableSoftDelete": "[parameters('enableSoftDelete')]",
+                "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]",
+                "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]",
+                "createMode": "[parameters('createMode')]",
+                "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]",
+                "tenantId": "[subscription().tenantId]",
+                "accessPolicies": "[variables('formattedAccessPolicies')]",
+                "sku": {
+                  "name": "[parameters('sku')]",
+                  "family": "A"
+                },
+                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]"
+              }
+            },
+            "keyVault_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            },
+            "keyVault_diagnosticSettings": {
+              "copy": {
+                "name": "keyVault_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            },
+            "keyVault_roleAssignments": {
+              "copy": {
+                "name": "keyVault_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            },
+            "keyVault_accessPolicies": {
+              "condition": "[not(empty(parameters('accessPolicies')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "keyVaultName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "accessPolicies": {
+                    "value": "[parameters('accessPolicies')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "9363032158799379271"
+                    },
+                    "name": "Key Vault Access Policies",
+                    "description": "This module deploys a Key Vault Access Policy.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "accessPoliciesType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "tenantId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                            }
+                          },
+                          "objectId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                            }
+                          },
+                          "applicationId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Application ID of the client making request on behalf of a principal."
+                            }
+                          },
+                          "permissions": {
+                            "type": "object",
+                            "properties": {
+                              "keys": {
+                                "type": "array",
+                                "allowedValues": [
+                                  "all",
+                                  "backup",
+                                  "create",
+                                  "decrypt",
+                                  "delete",
+                                  "encrypt",
+                                  "get",
+                                  "getrotationpolicy",
+                                  "import",
+                                  "list",
+                                  "purge",
+                                  "recover",
+                                  "release",
+                                  "restore",
+                                  "rotate",
+                                  "setrotationpolicy",
+                                  "sign",
+                                  "unwrapKey",
+                                  "update",
+                                  "verify",
+                                  "wrapKey"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Permissions to keys."
+                                }
+                              },
+                              "secrets": {
+                                "type": "array",
+                                "allowedValues": [
+                                  "all",
+                                  "backup",
+                                  "delete",
+                                  "get",
+                                  "list",
+                                  "purge",
+                                  "recover",
+                                  "restore",
+                                  "set"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Permissions to secrets."
+                                }
+                              },
+                              "certificates": {
+                                "type": "array",
+                                "allowedValues": [
+                                  "all",
+                                  "backup",
+                                  "create",
+                                  "delete",
+                                  "deleteissuers",
+                                  "get",
+                                  "getissuers",
+                                  "import",
+                                  "list",
+                                  "listissuers",
+                                  "managecontacts",
+                                  "manageissuers",
+                                  "purge",
+                                  "recover",
+                                  "restore",
+                                  "setissuers",
+                                  "update"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Permissions to certificates."
+                                }
+                              },
+                              "storage": {
+                                "type": "array",
+                                "allowedValues": [
+                                  "all",
+                                  "backup",
+                                  "delete",
+                                  "deletesas",
+                                  "get",
+                                  "getsas",
+                                  "list",
+                                  "listsas",
+                                  "purge",
+                                  "recover",
+                                  "regeneratekey",
+                                  "restore",
+                                  "set",
+                                  "setsas",
+                                  "update"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Permissions to storage accounts."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "accessPolicies": {
+                      "$ref": "#/definitions/accessPoliciesType",
+                      "metadata": {
+                        "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedAccessPolicies",
+                        "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
+                        "input": {
+                          "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
+                          "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
+                          "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
+                          "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
+                        }
+                      }
+                    ]
+                  },
+                  "resources": {
+                    "keyVault": {
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2022-07-01",
+                      "name": "[parameters('keyVaultName')]"
+                    },
+                    "policies": {
+                      "type": "Microsoft.KeyVault/vaults/accessPolicies",
+                      "apiVersion": "2022-07-01",
+                      "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]",
+                      "properties": {
+                        "accessPolicies": "[variables('formattedAccessPolicies')]"
+                      },
+                      "dependsOn": [
+                        "keyVault"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the access policies assignment was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the access policies assignment."
+                      },
+                      "value": "add"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the access policies assignment."
+                      },
+                      "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            },
+            "keyVault_secrets": {
+              "copy": {
+                "name": "keyVault_secrets",
+                "count": "[length(coalesce(parameters('secrets'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]"
+                  },
+                  "value": {
+                    "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]"
+                  },
+                  "keyVaultName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "attributesEnabled": {
+                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesEnabled')]"
+                  },
+                  "attributesExp": {
+                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesExp')]"
+                  },
+                  "attributesNbf": {
+                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesNbf')]"
+                  },
+                  "contentType": {
+                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "8081761451262814691"
+                    },
+                    "name": "Key Vault Secrets",
+                    "description": "This module deploys a Key Vault Secret.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the secret."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource tags."
+                      }
+                    },
+                    "attributesEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Determines whether the object is enabled."
+                      }
+                    },
+                    "attributesExp": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                      }
+                    },
+                    "attributesNbf": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                      }
+                    },
+                    "contentType": {
+                      "type": "securestring",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The content type of the secret."
+                      }
+                    },
+                    "value": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                      "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
+                      "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "keyVault": {
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2022-07-01",
+                      "name": "[parameters('keyVaultName')]"
+                    },
+                    "secret": {
+                      "type": "Microsoft.KeyVault/vaults/secrets",
+                      "apiVersion": "2022-07-01",
+                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "contentType": "[parameters('contentType')]",
+                        "attributes": {
+                          "enabled": "[parameters('attributesEnabled')]",
+                          "exp": "[parameters('attributesExp')]",
+                          "nbf": "[parameters('attributesNbf')]"
+                        },
+                        "value": "[parameters('value')]"
+                      },
+                      "dependsOn": [
+                        "keyVault"
+                      ]
+                    },
+                    "secret_roleAssignments": {
+                      "copy": {
+                        "name": "secret_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "secret"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the secret."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the secret."
+                      },
+                      "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the secret was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            },
+            "keyVault_keys": {
+              "copy": {
+                "name": "keyVault_keys",
+                "count": "[length(coalesce(parameters('keys'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]"
+                  },
+                  "keyVaultName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "attributesEnabled": {
+                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesEnabled')]"
+                  },
+                  "attributesExp": {
+                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesExp')]"
+                  },
+                  "attributesNbf": {
+                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesNbf')]"
+                  },
+                  "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]",
+                  "keyOps": {
+                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]"
+                  },
+                  "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]",
+                  "releasePolicy": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]"
+                  },
+                  "kty": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "rotationPolicy": {
+                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "6463446681908714455"
+                    },
+                    "name": "Key Vault Keys",
+                    "description": "This module deploys a Key Vault Key.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the key."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource tags."
+                      }
+                    },
+                    "attributesEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Determines whether the object is enabled."
+                      }
+                    },
+                    "attributesExp": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                      }
+                    },
+                    "attributesNbf": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                      }
+                    },
+                    "curveName": {
+                      "type": "string",
+                      "defaultValue": "P-256",
+                      "allowedValues": [
+                        "P-256",
+                        "P-256K",
+                        "P-384",
+                        "P-521"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The elliptic curve name."
+                      }
+                    },
+                    "keyOps": {
+                      "type": "array",
+                      "nullable": true,
+                      "allowedValues": [
+                        "decrypt",
+                        "encrypt",
+                        "import",
+                        "sign",
+                        "unwrapKey",
+                        "verify",
+                        "wrapKey"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Array of JsonWebKeyOperation."
+                      }
+                    },
+                    "keySize": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA."
+                      }
+                    },
+                    "kty": {
+                      "type": "string",
+                      "defaultValue": "EC",
+                      "allowedValues": [
+                        "EC",
+                        "EC-HSM",
+                        "RSA",
+                        "RSA-HSM"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The type of the key."
+                      }
+                    },
+                    "releasePolicy": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key release policy."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "rotationPolicy": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key rotation policy properties object."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                      "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
+                      "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
+                      "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
+                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "keyVault": {
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2022-07-01",
+                      "name": "[parameters('keyVaultName')]"
+                    },
+                    "key": {
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2022-07-01",
+                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "attributes": {
+                          "enabled": "[parameters('attributesEnabled')]",
+                          "exp": "[parameters('attributesExp')]",
+                          "nbf": "[parameters('attributesNbf')]"
+                        },
+                        "curveName": "[parameters('curveName')]",
+                        "keyOps": "[parameters('keyOps')]",
+                        "keySize": "[parameters('keySize')]",
+                        "kty": "[parameters('kty')]",
+                        "rotationPolicy": "[coalesce(parameters('rotationPolicy'), createObject())]",
+                        "release_policy": "[coalesce(parameters('releasePolicy'), createObject())]"
+                      },
+                      "dependsOn": [
+                        "keyVault"
+                      ]
+                    },
+                    "key_roleAssignments": {
+                      "copy": {
+                        "name": "key_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "key"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the key."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the key."
+                      },
+                      "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the key was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            },
+            "keyVault_privateEndpoints": {
+              "copy": {
+                "name": "keyVault_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]"
+                  },
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroupName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.25.53.49325",
+                      "templateHash": "4120048060064073955"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "ipConfigurationsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the resource that is unique within a resource group."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "memberName": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateIPAddress": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private endpoint IP configurations."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "manualPrivateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "privateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "customDnsConfigType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "fqdn": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                            }
+                          },
+                          "ipAddresses": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. A list of private IP addresses of the private endpoint."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "$ref": "#/definitions/ipConfigurationsType",
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroupName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                      }
+                    },
+                    "privateDnsZoneResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                          },
+                          "privateDNSResourceIds": {
+                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "11244630631275470040"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDNSResourceIds": {
+                              "type": "array",
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigs",
+                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                "input": {
+                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the key vault."
+              },
+              "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the resource group the key vault was created in."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the key vault."
+              },
+              "value": "[parameters('name')]"
+            },
+            "uri": {
+              "type": "string",
+              "metadata": {
+                "description": "The URI of the key vault."
+              },
+              "value": "[reference('keyVault').vaultUri]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('keyVault', '2022-07-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace",
+        "managedIdentityHub",
+        "managedIdentityProject"
+      ]
+    },
+    "storageAccount": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-storage', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('storageAccountConfiguration'), 'name'), format('st{0}', parameters('name')))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "skuName": {
+            "value": "[coalesce(tryGet(parameters('storageAccountConfiguration'), 'sku'), 'Standard_RAGZRS')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "allowBlobPublicAccess": {
+            "value": false
+          },
+          "allowSharedKeyAccess": {
+            "value": "[coalesce(tryGet(parameters('storageAccountConfiguration'), 'allowSharedKeyAccess'), true())]"
+          },
+          "defaultToOAuthAuthentication": {
+            "value": "[not(coalesce(tryGet(parameters('storageAccountConfiguration'), 'allowSharedKeyAccess'), true()))]"
+          },
+          "publicNetworkAccess": {
+            "value": "Disabled"
+          },
+          "networkAcls": {
+            "value": {
+              "defaultAction": "Deny",
+              "bypass": "AzureServices"
+            }
+          },
+          "privateEndpoints": "[if(not(equals(variables('subnetResourceId'), null())), createObject('value', map(items(variables('storagePrivateDnsZones')), lambda('zone', createObject('name', format('pep-{0}-{1}', lambdaVariables('zone').value, parameters('name')), 'customNetworkInterfaceName', format('nic-{0}-{1}', lambdaVariables('zone').value, parameters('name')), 'service', lambdaVariables('zone').value, 'subnetResourceId', coalesce(variables('subnetResourceId'), ''), 'privateDnsZoneResourceIds', createArray(resourceId('Microsoft.Network/privateDnsZones', lambdaVariables('zone').key)))))), createObject('value', null()))]",
+          "roleAssignments": {
+            "value": [
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Reader",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Storage Account Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Storage Table Data Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Storage Blob Data Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Storage Blob Data Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "69566ab7-960f-475b-8e7c-b3118f30c6bd",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "69566ab7-960f-475b-8e7c-b3118f30c6bd",
+                "principalType": "ServicePrincipal"
+              }
+            ]
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "7296091181254270609"
+            },
+            "name": "Storage Accounts",
+            "description": "This module deploys a Storage Account.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "networkAclsType": {
+              "type": "object",
+              "properties": {
+                "resourceAccessRules": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "tenantId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The ID of the tenant in which the resource resides in."
+                        }
+                      },
+                      "resourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
+                        }
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
+                  }
+                },
+                "bypass": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AzureServices",
+                    "AzureServices, Logging",
+                    "AzureServices, Logging, Metrics",
+                    "AzureServices, Metrics",
+                    "Logging",
+                    "Logging, Metrics",
+                    "Metrics",
+                    "None"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
+                  }
+                },
+                "virtualNetworkRules": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Sets the virtual network rules."
+                  }
+                },
+                "ipRules": {
+                  "type": "array",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Sets the IP ACL rules."
+                  }
+                },
+                "defaultAction": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Allow",
+                    "Deny"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specifies the default action of allow or deny when no other rules match."
+                  }
+                }
+              }
+            },
+            "privateEndpointType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private endpoint."
+                    }
+                  },
+                  "location": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The location to deploy the private endpoint to."
+                    }
+                  },
+                  "privateLinkServiceConnectionName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private link connection to create."
+                    }
+                  },
+                  "service": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\"."
+                    }
+                  },
+                  "subnetResourceId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                    }
+                  },
+                  "privateDnsZoneGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided."
+                    }
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                    }
+                  },
+                  "isManualConnection": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. If Manual Private Link Connection is required."
+                    }
+                  },
+                  "manualConnectionRequestMessage": {
+                    "type": "string",
+                    "nullable": true,
+                    "maxLength": 140,
+                    "metadata": {
+                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                    }
+                  },
+                  "customDnsConfigs": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Required. Fqdn that resolves to private endpoint ip address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private ip addresses of the private endpoint."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Custom DNS configurations."
+                    }
+                  },
+                  "ipConfigurations": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private ip address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                    }
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                    }
+                  },
+                  "customNetworkInterfaceName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                    }
+                  },
+                  "lock": {
+                    "$ref": "#/definitions/lockType",
+                    "metadata": {
+                      "description": "Optional. Specify the type of lock."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                    }
+                  },
+                  "enableTelemetry": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Enable/Disable usage telemetry for module."
+                    }
+                  },
+                  "resourceGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
+                  },
+                  "metricCategories": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "customerManagedKeyType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                  }
+                },
+                "keyName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the customer managed key to use for encryption."
+                  }
+                },
+                "keyVersion": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
+                  }
+                },
+                "userAssignedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. User assigned identity to use when fetching the customer managed key. If used must also be specified in `managedIdentities.userAssignedResourceIds`. Required if no system assigned identity is available for use."
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "maxLength": 24,
+              "metadata": {
+                "description": "Required. Name of the Storage Account. Must be lower-case."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "StorageV2",
+              "allowedValues": [
+                "Storage",
+                "StorageV2",
+                "BlobStorage",
+                "FileStorage",
+                "BlockBlobStorage"
+              ],
+              "metadata": {
+                "description": "Optional. Type of Storage Account to create."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Standard_GRS",
+              "allowedValues": [
+                "Standard_LRS",
+                "Standard_GRS",
+                "Standard_RAGRS",
+                "Standard_ZRS",
+                "Premium_LRS",
+                "Premium_ZRS",
+                "Standard_GZRS",
+                "Standard_RAGZRS"
+              ],
+              "metadata": {
+                "description": "Optional. Storage Account Sku Name."
+              }
+            },
+            "accessTier": {
+              "type": "string",
+              "defaultValue": "Hot",
+              "allowedValues": [
+                "Premium",
+                "Hot",
+                "Cool"
+              ],
+              "metadata": {
+                "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
+              }
+            },
+            "largeFileSharesState": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Disabled",
+                "Enabled"
+              ],
+              "metadata": {
+                "description": "Optional. Allow large file shares if sets to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
+              }
+            },
+            "azureFilesIdentityBasedAuthentication": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Provides the identity based authentication settings for Azure Files."
+              }
+            },
+            "defaultToOAuthAuthentication": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
+              }
+            },
+            "allowSharedKeyAccess": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
+              }
+            },
+            "privateEndpoints": {
+              "$ref": "#/definitions/privateEndpointType",
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "managementPolicyRules": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The Storage Account ManagementPolicies Rules."
+              }
+            },
+            "networkAcls": {
+              "$ref": "#/definitions/networkAclsType",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
+              }
+            },
+            "requireInfrastructureEncryption": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
+              }
+            },
+            "allowCrossTenantReplication": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Allow or disallow cross AAD tenant object replication."
+              }
+            },
+            "customDomainName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
+              }
+            },
+            "customDomainUseSubDomainName": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
+              }
+            },
+            "dnsEndpointType": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "",
+                "AzureDnsZone",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
+              }
+            },
+            "blobServices": {
+              "type": "object",
+              "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
+              "metadata": {
+                "description": "Optional. Blob service and containers to deploy."
+              }
+            },
+            "fileServices": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. File service and shares to deploy."
+              }
+            },
+            "queueServices": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Queue service and queues to create."
+              }
+            },
+            "tableServices": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Table service and tables to create."
+              }
+            },
+            "allowBlobPublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
+              }
+            },
+            "minimumTlsVersion": {
+              "type": "string",
+              "defaultValue": "TLS1_2",
+              "allowedValues": [
+                "TLS1_0",
+                "TLS1_1",
+                "TLS1_2"
+              ],
+              "metadata": {
+                "description": "Optional. Set the minimum TLS version on request to storage."
+              }
+            },
+            "enableHierarchicalNamespace": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
+              }
+            },
+            "enableSftp": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
+              }
+            },
+            "localUsers": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Local users to deploy for SFTP authentication."
+              }
+            },
+            "isLocalUserEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enables local users feature, if set to true."
+              }
+            },
+            "enableNfsV3": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "allowedCopyScope": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "",
+                "AAD",
+                "PrivateLink"
+              ],
+              "metadata": {
+                "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "",
+              "allowedValues": [
+                "",
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+              }
+            },
+            "supportsHttpsTrafficOnly": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
+              }
+            },
+            "customerManagedKey": {
+              "$ref": "#/definitions/customerManagedKeyType",
+              "metadata": {
+                "description": "Optional. The customer managed key definition."
+              }
+            },
+            "sasExpirationPeriod": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
+              }
+            },
+            "keyType": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "Account",
+                "Service"
+              ],
+              "metadata": {
+                "description": "Optional. The keyType to use with Queue & Table services."
+              }
+            }
+          },
+          "variables": {
+            "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+            "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+              "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+              "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+              "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+              "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+              "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+              "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+              "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+              "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+              "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+              "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+              "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+              "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+              "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "cMKKeyVault::cMKKey": {
+              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults/keys",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
+              "dependsOn": [
+                "cMKKeyVault"
+              ]
+            },
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "cMKKeyVault": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
+            },
+            "cMKUserAssignedIdentity": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2023-01-31",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
+            },
+            "storageAccount": {
+              "type": "Microsoft.Storage/storageAccounts",
+              "apiVersion": "2022-09-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "kind": "[parameters('kind')]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              },
+              "identity": "[variables('identity')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "allowSharedKeyAccess": "[parameters('allowSharedKeyAccess')]",
+                "defaultToOAuthAuthentication": "[parameters('defaultToOAuthAuthentication')]",
+                "allowCrossTenantReplication": "[parameters('allowCrossTenantReplication')]",
+                "allowedCopyScope": "[if(not(empty(parameters('allowedCopyScope'))), parameters('allowedCopyScope'), null())]",
+                "customDomain": {
+                  "name": "[parameters('customDomainName')]",
+                  "useSubDomainName": "[parameters('customDomainUseSubDomainName')]"
+                },
+                "dnsEndpointType": "[if(not(empty(parameters('dnsEndpointType'))), parameters('dnsEndpointType'), null())]",
+                "isLocalUserEnabled": "[parameters('isLocalUserEnabled')]",
+                "encryption": "[union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), parameters('customerManagedKey').keyVersion, last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/')))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2], split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject()))]",
+                "accessTier": "[if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null())]",
+                "sasPolicy": "[if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', 'Log', 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null())]",
+                "supportsHttpsTrafficOnly": "[parameters('supportsHttpsTrafficOnly')]",
+                "isHnsEnabled": "[if(parameters('enableHierarchicalNamespace'), parameters('enableHierarchicalNamespace'), null())]",
+                "isSftpEnabled": "[parameters('enableSftp')]",
+                "isNfsV3Enabled": "[if(parameters('enableNfsV3'), parameters('enableNfsV3'), '')]",
+                "largeFileSharesState": "[if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null())]",
+                "minimumTlsVersion": "[parameters('minimumTlsVersion')]",
+                "networkAcls": "[if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny'))]",
+                "allowBlobPublicAccess": "[parameters('allowBlobPublicAccess')]",
+                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))]",
+                "azureFilesIdentityBasedAuthentication": "[if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), parameters('azureFilesIdentityBasedAuthentication'), null())]"
+              },
+              "dependsOn": [
+                "cMKKeyVault",
+                "cMKUserAssignedIdentity"
+              ]
+            },
+            "storageAccount_diagnosticSettings": {
+              "copy": {
+                "name": "storageAccount_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_roleAssignments": {
+              "copy": {
+                "name": "storageAccount_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_privateEndpoints": {
+              "copy": {
+                "name": "storageAccount_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-storageAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                  },
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroupName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.25.53.49325",
+                      "templateHash": "4120048060064073955"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "ipConfigurationsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the resource that is unique within a resource group."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "memberName": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateIPAddress": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private endpoint IP configurations."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "manualPrivateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "privateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "customDnsConfigType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "fqdn": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                            }
+                          },
+                          "ipAddresses": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. A list of private IP addresses of the private endpoint."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "$ref": "#/definitions/ipConfigurationsType",
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroupName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                      }
+                    },
+                    "privateDnsZoneResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                          },
+                          "privateDNSResourceIds": {
+                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "11244630631275470040"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDNSResourceIds": {
+                              "type": "array",
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigs",
+                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                "input": {
+                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_managementPolicies": {
+              "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "storageAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "rules": {
+                    "value": "[coalesce(parameters('managementPolicyRules'), createArray())]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "9473195527943694039"
+                    },
+                    "name": "Storage Account Management Policies",
+                    "description": "This module deploys a Storage Account Management Policy.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "storageAccountName": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "rules": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Required. The Storage Account ManagementPolicies Rules."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Storage/storageAccounts/managementPolicies",
+                      "apiVersion": "2023-01-01",
+                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                      "properties": {
+                        "policy": {
+                          "rules": "[parameters('rules')]"
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed management policy."
+                      },
+                      "value": "default"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed management policy."
+                      },
+                      "value": "default"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed management policy."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount",
+                "storageAccount_blobServices"
+              ]
+            },
+            "storageAccount_localUsers": {
+              "copy": {
+                "name": "storageAccount_localUsers",
+                "count": "[length(parameters('localUsers'))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "storageAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "name": {
+                    "value": "[parameters('localUsers')[copyIndex()].name]"
+                  },
+                  "hasSshKey": {
+                    "value": "[parameters('localUsers')[copyIndex()].hasSshKey]"
+                  },
+                  "hasSshPassword": {
+                    "value": "[parameters('localUsers')[copyIndex()].hasSshPassword]"
+                  },
+                  "permissionScopes": {
+                    "value": "[parameters('localUsers')[copyIndex()].permissionScopes]"
+                  },
+                  "hasSharedKey": {
+                    "value": "[tryGet(parameters('localUsers')[copyIndex()], 'hasSharedKey')]"
+                  },
+                  "homeDirectory": {
+                    "value": "[tryGet(parameters('localUsers')[copyIndex()], 'homeDirectory')]"
+                  },
+                  "sshAuthorizedKeys": {
+                    "value": "[tryGet(parameters('localUsers')[copyIndex()], 'sshAuthorizedKeys')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "14968464858285923305"
+                    },
+                    "name": "Storage Account Local Users",
+                    "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "sshAuthorizedKeysType": {
+                      "type": "secureObject",
+                      "properties": {
+                        "secureList": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "description": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Description used to store the function/usage of the key."
+                                }
+                              },
+                              "key": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Optional. The list of SSH authorized keys."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "storageAccountName": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the local user used for SFTP Authentication."
+                      }
+                    },
+                    "hasSharedKey": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                      }
+                    },
+                    "hasSshKey": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                      }
+                    },
+                    "hasSshPassword": {
+                      "type": "bool",
+                      "metadata": {
+                        "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                      }
+                    },
+                    "homeDirectory": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The local user home directory."
+                      }
+                    },
+                    "permissionScopes": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Required. The permission scopes of the local user."
+                      }
+                    },
+                    "sshAuthorizedKeys": {
+                      "$ref": "#/definitions/sshAuthorizedKeysType",
+                      "metadata": {
+                        "description": "Optional. The local user SSH authorized keys for SFTP."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "storageAccount": {
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('storageAccountName')]"
+                    },
+                    "localUsers": {
+                      "type": "Microsoft.Storage/storageAccounts/localUsers",
+                      "apiVersion": "2023-04-01",
+                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                      "properties": {
+                        "hasSharedKey": "[parameters('hasSharedKey')]",
+                        "hasSshKey": "[parameters('hasSshKey')]",
+                        "hasSshPassword": "[parameters('hasSshPassword')]",
+                        "homeDirectory": "[parameters('homeDirectory')]",
+                        "permissionScopes": "[parameters('permissionScopes')]",
+                        "sshAuthorizedKeys": "[tryGet(parameters('sshAuthorizedKeys'), 'secureList')]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed local user."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed local user."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed local user."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_blobServices": {
+              "condition": "[not(empty(parameters('blobServices')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "storageAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "containers": {
+                    "value": "[tryGet(parameters('blobServices'), 'containers')]"
+                  },
+                  "automaticSnapshotPolicyEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
+                  },
+                  "changeFeedEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
+                  },
+                  "changeFeedRetentionInDays": {
+                    "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
+                  },
+                  "containerDeleteRetentionPolicyEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
+                  },
+                  "containerDeleteRetentionPolicyDays": {
+                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
+                  },
+                  "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
+                  },
+                  "corsRules": {
+                    "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
+                  },
+                  "defaultServiceVersion": {
+                    "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
+                  },
+                  "deleteRetentionPolicyAllowPermanentDelete": {
+                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
+                  },
+                  "deleteRetentionPolicyEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
+                  },
+                  "deleteRetentionPolicyDays": {
+                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
+                  },
+                  "isVersioningEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
+                  },
+                  "lastAccessTimeTrackingPolicyEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
+                  },
+                  "restorePolicyEnabled": {
+                    "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
+                  },
+                  "restorePolicyDays": {
+                    "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "2306287879023715578"
+                    },
+                    "name": "Storage Account blob Services",
+                    "description": "This module deploys a Storage Account Blob Service.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "storageAccountName": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "automaticSnapshotPolicyEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Automatic Snapshot is enabled if set to true."
+                      }
+                    },
+                    "changeFeedEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                      }
+                    },
+                    "changeFeedRetentionInDays": {
+                      "type": "int",
+                      "nullable": true,
+                      "minValue": 1,
+                      "maxValue": 146000,
+                      "metadata": {
+                        "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                      }
+                    },
+                    "containerDeleteRetentionPolicyEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                      }
+                    },
+                    "containerDeleteRetentionPolicyDays": {
+                      "type": "int",
+                      "nullable": true,
+                      "minValue": 1,
+                      "maxValue": 365,
+                      "metadata": {
+                        "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                      }
+                    },
+                    "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                      }
+                    },
+                    "corsRules": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Specifies CORS rules for the Blob service. You can include up to five CorsRule elements in the request. If no CorsRule elements are included in the request body, all CORS rules will be deleted, and CORS will be disabled for the Blob service."
+                      }
+                    },
+                    "defaultServiceVersion": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                      }
+                    },
+                    "deleteRetentionPolicyEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. The blob service properties for blob soft delete."
+                      }
+                    },
+                    "deleteRetentionPolicyDays": {
+                      "type": "int",
+                      "defaultValue": 7,
+                      "minValue": 1,
+                      "maxValue": 365,
+                      "metadata": {
+                        "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                      }
+                    },
+                    "deleteRetentionPolicyAllowPermanentDelete": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                      }
+                    },
+                    "isVersioningEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Use versioning to automatically maintain previous versions of your blobs."
+                      }
+                    },
+                    "lastAccessTimeTrackingPolicyEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                      }
+                    },
+                    "restorePolicyEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                      }
+                    },
+                    "restorePolicyDays": {
+                      "type": "int",
+                      "defaultValue": 6,
+                      "minValue": 1,
+                      "metadata": {
+                        "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Blob containers to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "name": "default"
+                  },
+                  "resources": {
+                    "storageAccount": {
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2022-09-01",
+                      "name": "[parameters('storageAccountName')]"
+                    },
+                    "blobServices": {
+                      "type": "Microsoft.Storage/storageAccounts/blobServices",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "properties": {
+                        "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
+                        "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
+                        "containerDeleteRetentionPolicy": {
+                          "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
+                          "days": "[parameters('containerDeleteRetentionPolicyDays')]",
+                          "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
+                        },
+                        "cors": {
+                          "corsRules": "[parameters('corsRules')]"
+                        },
+                        "defaultServiceVersion": "[if(not(empty(parameters('defaultServiceVersion'))), parameters('defaultServiceVersion'), null())]",
+                        "deleteRetentionPolicy": {
+                          "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
+                          "days": "[parameters('deleteRetentionPolicyDays')]",
+                          "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
+                        },
+                        "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
+                        "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2022-09-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
+                        "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "blobServices_diagnosticSettings": {
+                      "copy": {
+                        "name": "blobServices_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "blobServices"
+                      ]
+                    },
+                    "blobServices_container": {
+                      "copy": {
+                        "name": "blobServices_container",
+                        "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('storageAccountName')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                          },
+                          "defaultEncryptionScope": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
+                          },
+                          "denyEncryptionScopeOverride": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
+                          },
+                          "enableNfsV3AllSquash": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
+                          },
+                          "enableNfsV3RootSquash": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
+                          },
+                          "immutableStorageWithVersioningEnabled": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "publicAccess": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "immutabilityPolicyProperties": {
+                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicyProperties')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "7045309160947869799"
+                            },
+                            "name": "Storage Account Blob Containers",
+                            "description": "This module deploys a Storage Account Blob Container.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the storage container to deploy."
+                              }
+                            },
+                            "defaultEncryptionScope": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Default the container to use specified encryption scope for all writes."
+                              }
+                            },
+                            "denyEncryptionScopeOverride": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Block override of encryption scope from the container default."
+                              }
+                            },
+                            "enableNfsV3AllSquash": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enable NFSv3 all squash on blob container."
+                              }
+                            },
+                            "enableNfsV3RootSquash": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enable NFSv3 root squash on blob container."
+                              }
+                            },
+                            "immutableStorageWithVersioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                              }
+                            },
+                            "immutabilityPolicyName": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. Name of the immutable policy."
+                              }
+                            },
+                            "immutabilityPolicyProperties": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configure immutability policy."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. A name-value pair to associate with the container as metadata."
+                              }
+                            },
+                            "publicAccess": {
+                              "type": "string",
+                              "defaultValue": "None",
+                              "allowedValues": [
+                                "Container",
+                                "Blob",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                              "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                              "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                              "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                              "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "storageAccount::blobServices": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts/blobServices",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2022-09-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "container": {
+                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                              "properties": {
+                                "defaultEncryptionScope": "[if(not(empty(parameters('defaultEncryptionScope'))), parameters('defaultEncryptionScope'), null())]",
+                                "denyEncryptionScopeOverride": "[if(equals(parameters('denyEncryptionScopeOverride'), true()), parameters('denyEncryptionScopeOverride'), null())]",
+                                "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
+                                "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
+                                "immutableStorageWithVersioning": "[if(equals(parameters('immutableStorageWithVersioningEnabled'), true()), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
+                                "metadata": "[parameters('metadata')]",
+                                "publicAccess": "[parameters('publicAccess')]"
+                              },
+                              "dependsOn": [
+                                "storageAccount::blobServices"
+                              ]
+                            },
+                            "container_roleAssignments": {
+                              "copy": {
+                                "name": "container_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "container"
+                              ]
+                            },
+                            "immutabilityPolicy": {
+                              "condition": "[not(empty(coalesce(parameters('immutabilityPolicyProperties'), createObject())))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[parameters('immutabilityPolicyName')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "containerName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "immutabilityPeriodSinceCreationInDays": {
+                                    "value": "[tryGet(parameters('immutabilityPolicyProperties'), 'immutabilityPeriodSinceCreationInDays')]"
+                                  },
+                                  "allowProtectedAppendWrites": {
+                                    "value": "[tryGet(parameters('immutabilityPolicyProperties'), 'allowProtectedAppendWrites')]"
+                                  },
+                                  "allowProtectedAppendWritesAll": {
+                                    "value": "[tryGet(parameters('immutabilityPolicyProperties'), 'allowProtectedAppendWritesAll')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "2543276032744560941"
+                                    },
+                                    "name": "Storage Account Blob Container Immutability Policies",
+                                    "description": "This module deploys a Storage Account Blob Container Immutability Policy.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "containerName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "immutabilityPeriodSinceCreationInDays": {
+                                      "type": "int",
+                                      "defaultValue": 365,
+                                      "metadata": {
+                                        "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                      }
+                                    },
+                                    "allowProtectedAppendWrites": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                                      }
+                                    },
+                                    "allowProtectedAppendWritesAll": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]",
+                                      "properties": {
+                                        "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
+                                        "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
+                                        "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed immutability policy."
+                                      },
+                                      "value": "default"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed immutability policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed immutability policy."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "container",
+                                "storageAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed container."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed container."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed container."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed blob service."
+                      },
+                      "value": "[variables('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed blob service."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed blob service."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_fileServices": {
+              "condition": "[not(empty(parameters('fileServices')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "storageAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
+                  },
+                  "protocolSettings": {
+                    "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
+                  },
+                  "shareDeleteRetentionPolicy": {
+                    "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
+                  },
+                  "shares": {
+                    "value": "[tryGet(parameters('fileServices'), 'shares')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "7463227074634701879"
+                    },
+                    "name": "Storage Account File Share Services",
+                    "description": "This module deploys a Storage Account File Share Service.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "storageAccountName": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "default",
+                      "metadata": {
+                        "description": "Optional. The name of the file service."
+                      }
+                    },
+                    "protocolSettings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Protocol settings for file service."
+                      }
+                    },
+                    "shareDeleteRetentionPolicy": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": true,
+                        "days": 7
+                      },
+                      "metadata": {
+                        "description": "Optional. The service properties for soft delete."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "shares": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. File shares to create."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "storageAccount": {
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('storageAccountName')]"
+                    },
+                    "fileServices": {
+                      "type": "Microsoft.Storage/storageAccounts/fileServices",
+                      "apiVersion": "2023-04-01",
+                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                      "properties": {
+                        "protocolSettings": "[parameters('protocolSettings')]",
+                        "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "fileServices_diagnosticSettings": {
+                      "copy": {
+                        "name": "fileServices_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "fileServices"
+                      ]
+                    },
+                    "fileServices_shares": {
+                      "copy": {
+                        "name": "fileServices_shares",
+                        "count": "[length(coalesce(parameters('shares'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('storageAccountName')]"
+                          },
+                          "fileServicesName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
+                          },
+                          "accessTier": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2023-04-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]"
+                          },
+                          "enabledProtocols": {
+                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
+                          },
+                          "rootSquash": {
+                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
+                          },
+                          "shareQuota": {
+                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "1342480740201032357"
+                            },
+                            "name": "Storage Account File Shares",
+                            "description": "This module deploys a Storage Account File Share.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "fileServicesName": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the file share to create."
+                              }
+                            },
+                            "accessTier": {
+                              "type": "string",
+                              "defaultValue": "TransactionOptimized",
+                              "allowedValues": [
+                                "Premium",
+                                "Hot",
+                                "Cool",
+                                "TransactionOptimized"
+                              ],
+                              "metadata": {
+                                "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                              }
+                            },
+                            "shareQuota": {
+                              "type": "int",
+                              "defaultValue": 5120,
+                              "metadata": {
+                                "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                              }
+                            },
+                            "enabledProtocols": {
+                              "type": "string",
+                              "defaultValue": "SMB",
+                              "allowedValues": [
+                                "NFS",
+                                "SMB"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                              }
+                            },
+                            "rootSquash": {
+                              "type": "string",
+                              "defaultValue": "NoRootSquash",
+                              "allowedValues": [
+                                "AllSquash",
+                                "NoRootSquash",
+                                "RootSquash"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "storageAccount::fileService": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts/fileServices",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]",
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "fileShare": {
+                              "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
+                              "apiVersion": "2023-01-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
+                              "properties": {
+                                "accessTier": "[parameters('accessTier')]",
+                                "shareQuota": "[parameters('shareQuota')]",
+                                "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
+                                "enabledProtocols": "[parameters('enabledProtocols')]"
+                              },
+                              "dependsOn": [
+                                "storageAccount::fileService"
+                              ]
+                            },
+                            "fileShare_roleAssignments": {
+                              "condition": "[not(empty(parameters('roleAssignments')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Share-Rbac', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "fileShareResourceId": {
+                                    "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.28.1.47646",
+                                      "templateHash": "8779226603522513073"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "fileShareResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource id of the file share to assign the roles to."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "$fxv#0": {
+                                      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                      "contentVersion": "1.0.0.0",
+                                      "parameters": {
+                                        "scope": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The scope to deploy the role assignment to."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the role assignment."
+                                          }
+                                        },
+                                        "roleDefinitionId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role definition Id to assign."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User",
+                                            ""
+                                          ],
+                                          "defaultValue": "",
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "defaultValue": "",
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "defaultValue": "",
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "defaultValue": "2.0",
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "defaultValue": "",
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "resources": [
+                                        {
+                                          "type": "Microsoft.Authorization/roleAssignments",
+                                          "apiVersion": "2022-04-01",
+                                          "scope": "[[parameters('scope')]",
+                                          "name": "[[parameters('name')]",
+                                          "properties": {
+                                            "roleDefinitionId": "[[parameters('roleDefinitionId')]",
+                                            "principalId": "[[parameters('principalId')]",
+                                            "description": "[[parameters('description')]",
+                                            "principalType": "[[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
+                                            "condition": "[[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
+                                            "conditionVersion": "[[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
+                                            "delegatedManagedIdentityResourceId": "[[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
+                                          }
+                                        }
+                                      ]
+                                    },
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "copy": {
+                                        "name": "fileShare_roleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2021-04-01",
+                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "expressionEvaluationOptions": {
+                                          "scope": "Outer"
+                                        },
+                                        "template": "[variables('$fxv#0')]",
+                                        "parameters": {
+                                          "scope": {
+                                            "value": "[replace(parameters('fileShareResourceId'), '/shares/', '/fileShares/')]"
+                                          },
+                                          "name": {
+                                            "value": "[guid(parameters('fileShareResourceId'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, 'tyfa')]"
+                                          },
+                                          "roleDefinitionId": {
+                                            "value": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]"
+                                          },
+                                          "principalId": {
+                                            "value": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]"
+                                          },
+                                          "principalType": {
+                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                                          },
+                                          "description": {
+                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]"
+                                          },
+                                          "condition": {
+                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]"
+                                          },
+                                          "conditionVersion": {
+                                            "value": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]"
+                                          },
+                                          "delegatedManagedIdentityResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                          }
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "fileShare"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed file share."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed file share."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed file share."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "fileServices",
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed file share service."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed file share service."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed file share service."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_queueServices": {
+              "condition": "[not(empty(parameters('queueServices')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "storageAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
+                  },
+                  "queues": {
+                    "value": "[tryGet(parameters('queueServices'), 'queues')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "10678250016540336570"
+                    },
+                    "name": "Storage Account Queue Services",
+                    "description": "This module deploys a Storage Account Queue Service.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "storageAccountName": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "queues": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Queues to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "name": "default"
+                  },
+                  "resources": {
+                    "storageAccount": {
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('storageAccountName')]"
+                    },
+                    "queueServices": {
+                      "type": "Microsoft.Storage/storageAccounts/queueServices",
+                      "apiVersion": "2023-04-01",
+                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "properties": {},
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "queueServices_diagnosticSettings": {
+                      "copy": {
+                        "name": "queueServices_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "queueServices"
+                      ]
+                    },
+                    "queueServices_queues": {
+                      "copy": {
+                        "name": "queueServices_queues",
+                        "count": "[length(coalesce(parameters('queues'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('storageAccountName')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "13487964166280180730"
+                            },
+                            "name": "Storage Account Queues",
+                            "description": "This module deploys a Storage Account Queue.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the storage queue to deploy."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Required. A name-value pair that represents queue metadata."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                              "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                              "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                              "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                              "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "storageAccount::queueServices": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts/queueServices",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "queue": {
+                              "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]"
+                              },
+                              "dependsOn": [
+                                "storageAccount::queueServices"
+                              ]
+                            },
+                            "queue_roleAssignments": {
+                              "copy": {
+                                "name": "queue_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "queue"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed queue."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed queue."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed queue."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed file share service."
+                      },
+                      "value": "[variables('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed file share service."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed file share service."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            },
+            "storageAccount_tableServices": {
+              "condition": "[not(empty(parameters('tableServices')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "storageAccountName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
+                  },
+                  "tables": {
+                    "value": "[tryGet(parameters('tableServices'), 'tables')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "16839054392438941735"
+                    },
+                    "name": "Storage Account Table Services",
+                    "description": "This module deploys a Storage Account Table Service.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "diagnosticSettingType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of diagnostic setting."
+                            }
+                          },
+                          "logCategoriesAndGroups": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                  }
+                                },
+                                "categoryGroup": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "metricCategories": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                  }
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                            }
+                          },
+                          "logAnalyticsDestinationType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "AzureDiagnostics",
+                              "Dedicated"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                            }
+                          },
+                          "workspaceResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "storageAccountResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "eventHubAuthorizationRuleResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                            }
+                          },
+                          "eventHubName": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                            }
+                          },
+                          "marketplacePartnerResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "storageAccountName": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. tables to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "$ref": "#/definitions/diagnosticSettingType",
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "name": "default"
+                  },
+                  "resources": {
+                    "storageAccount": {
+                      "existing": true,
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('storageAccountName')]"
+                    },
+                    "tableServices": {
+                      "type": "Microsoft.Storage/storageAccounts/tableServices",
+                      "apiVersion": "2023-04-01",
+                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "properties": {},
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "tableServices_diagnosticSettings": {
+                      "copy": {
+                        "name": "tableServices_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "tableServices"
+                      ]
+                    },
+                    "tableServices_tables": {
+                      "copy": {
+                        "name": "tableServices_tables",
+                        "count": "[length(parameters('tables'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('tables')[copyIndex()].name]"
+                          },
+                          "storageAccountName": {
+                            "value": "[parameters('storageAccountName')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.28.1.47646",
+                              "templateHash": "3177845984945141330"
+                            },
+                            "name": "Storage Account Table",
+                            "description": "This module deploys a Storage Account Table.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "roleDefinitionIdOrName": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                    }
+                                  },
+                                  "principalId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                    }
+                                  },
+                                  "principalType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Device",
+                                      "ForeignGroup",
+                                      "Group",
+                                      "ServicePrincipal",
+                                      "User"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The principal type of the assigned principal ID."
+                                    }
+                                  },
+                                  "description": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The description of the role assignment."
+                                    }
+                                  },
+                                  "condition": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    }
+                                  },
+                                  "conditionVersion": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "2.0"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Version of the condition."
+                                    }
+                                  },
+                                  "delegatedManagedIdentityResourceId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "roleAssignments": {
+                              "$ref": "#/definitions/roleAssignmentType",
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the table."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                              "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                              "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "storageAccount::tableServices": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts/tableServices",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "table": {
+                              "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                              "dependsOn": [
+                                "storageAccount::tableServices"
+                              ]
+                            },
+                            "table_roleAssignments": {
+                              "copy": {
+                                "name": "table_roleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "properties": {
+                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "table"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed file share service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed file share service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed file share service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed table service."
+                      },
+                      "value": "[variables('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed table service."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed table service."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "storageAccount"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the deployed storage account."
+              },
+              "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the deployed storage account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group of the deployed storage account."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "primaryBlobEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "The primary blob endpoint reference if blob services are deployed."
+              },
+              "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('storageAccount', '2022-09-01', 'full'), 'identity'), 'principalId'), '')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('storageAccount', '2022-09-01', 'full').location]"
+            },
+            "serviceEndpoints": {
+              "type": "object",
+              "metadata": {
+                "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
+              },
+              "value": "[reference('storageAccount').primaryEndpoints]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork::defaultSubnet",
+        "managedIdentityHub",
+        "managedIdentityProject",
+        "storageAccount_privateDnsZones"
+      ]
+    },
+    "containerRegistry": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-container-registry', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('containerRegistryConfiguration'), 'name'), format('cr{0}', parameters('name')))]"
+          },
+          "acrSku": {
+            "value": "Premium"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "publicNetworkAccess": {
+            "value": "Disabled"
+          },
+          "networkRuleBypassOptions": {
+            "value": "AzureServices"
+          },
+          "zoneRedundancy": {
+            "value": "Enabled"
+          },
+          "trustPolicyStatus": {
+            "value": "[coalesce(tryGet(parameters('containerRegistryConfiguration'), 'trustPolicyStatus'), 'enabled')]"
+          },
+          "roleAssignments": {
+            "value": [
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "AcrPull",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "AcrPull",
+                "principalType": "ServicePrincipal"
+              }
+            ]
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.28.1.47646",
+              "templateHash": "4907495916128135857"
+            },
+            "name": "Azure Container Registries (ACR)",
+            "description": "This module deploys an Azure Container Registry (ACR).",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "privateEndpointType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private endpoint."
+                    }
+                  },
+                  "location": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The location to deploy the private endpoint to."
+                    }
+                  },
+                  "privateLinkServiceConnectionName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private link connection to create."
+                    }
+                  },
+                  "service": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                    }
+                  },
+                  "subnetResourceId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                    }
+                  },
+                  "privateDnsZoneGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                    }
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                    }
+                  },
+                  "isManualConnection": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. If Manual Private Link Connection is required."
+                    }
+                  },
+                  "manualConnectionRequestMessage": {
+                    "type": "string",
+                    "nullable": true,
+                    "maxLength": 140,
+                    "metadata": {
+                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                    }
+                  },
+                  "customDnsConfigs": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Required. Fqdn that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Custom DNS configurations."
+                    }
+                  },
+                  "ipConfigurations": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                    }
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                    }
+                  },
+                  "customNetworkInterfaceName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                    }
+                  },
+                  "lock": {
+                    "$ref": "#/definitions/lockType",
+                    "metadata": {
+                      "description": "Optional. Specify the type of lock."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                    }
+                  },
+                  "enableTelemetry": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Enable/Disable usage telemetry for module."
+                    }
+                  },
+                  "resourceGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
+                  },
+                  "logCategoriesAndGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                          }
+                        },
+                        "categoryGroup": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "metricCategories": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                    }
+                  },
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "customerManagedKeyType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                  }
+                },
+                "keyName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the customer managed key to use for encryption."
+                  }
+                },
+                "keyVersion": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
+                  }
+                },
+                "userAssignedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "minLength": 5,
+              "maxLength": 50,
+              "metadata": {
+                "description": "Required. Name of your Azure Container Registry."
+              }
+            },
+            "acrAdminUserEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enable admin user that have push / pull permission to the registry."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "acrSku": {
+              "type": "string",
+              "defaultValue": "Basic",
+              "allowedValues": [
+                "Basic",
+                "Premium",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. Tier of your Azure container registry."
+              }
+            },
+            "exportPolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the export policy is enabled or not."
+              }
+            },
+            "quarantinePolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "trustPolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "retentionPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+              }
+            },
+            "retentionPolicyDays": {
+              "type": "int",
+              "defaultValue": 15,
+              "metadata": {
+                "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
+              }
+            },
+            "azureADAuthenticationAsArmPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registr is enabled or not. Default is enabled."
+              }
+            },
+            "softDeletePolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. Soft Delete policy status. Default is disabled."
+              }
+            },
+            "softDeletePolicyDays": {
+              "type": "int",
+              "defaultValue": 7,
+              "metadata": {
+                "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
+              }
+            },
+            "dataEndpointEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "networkRuleBypassOptions": {
+              "type": "string",
+              "defaultValue": "AzureServices",
+              "allowedValues": [
+                "AzureServices",
+                "None"
+              ],
+              "metadata": {
+                "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
+              }
+            },
+            "networkRuleSetDefaultAction": {
+              "type": "string",
+              "defaultValue": "Deny",
+              "allowedValues": [
+                "Allow",
+                "Deny"
+              ],
+              "metadata": {
+                "description": "Optional. The default action of allow or deny when no other rules match."
+              }
+            },
+            "networkRuleSetIpRules": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "privateEndpoints": {
+              "$ref": "#/definitions/privateEndpointType",
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "zoneRedundancy": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Disabled",
+                "Enabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+              }
+            },
+            "replications": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. All replications to create."
+              }
+            },
+            "webhooks": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. All webhooks to create."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "anonymousPullEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+              }
+            },
+            "customerManagedKey": {
+              "$ref": "#/definitions/customerManagedKeyType",
+              "metadata": {
+                "description": "Optional. The customer managed key definition."
+              }
+            },
+            "cacheRules": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of Cache Rules. Note: This is a preview feature ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache#cache-for-acr-preview))."
+              }
+            }
+          },
+          "variables": {
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
+              "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
+              "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
+              "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
+              "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
+              "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "cMKKeyVault::cMKKey": {
+              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults/keys",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
+              "dependsOn": [
+                "cMKKeyVault"
+              ]
+            },
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "cMKKeyVault": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
+            },
+            "cMKUserAssignedIdentity": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2023-01-31",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
+            },
+            "registry": {
+              "type": "Microsoft.ContainerRegistry/registries",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "identity": "[variables('identity')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('acrSku')]"
+              },
+              "properties": {
+                "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
+                "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
+                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), reference('cMKKeyVault::cMKKey').keyUriWithVersion))), null())]",
+                "policies": {
+                  "azureADAuthenticationAsArmPolicy": {
+                    "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                  },
+                  "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
+                  "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
+                  "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
+                  "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
+                  "softDeletePolicy": {
+                    "retentionDays": "[parameters('softDeletePolicyDays')]",
+                    "status": "[parameters('softDeletePolicyStatus')]"
+                  }
+                },
+                "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
+                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
+                "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+                "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]",
+                "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
+              },
+              "dependsOn": [
+                "cMKKeyVault",
+                "cMKUserAssignedIdentity"
+              ]
+            },
+            "registry_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_diagnosticSettings": {
+              "copy": {
+                "name": "registry_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_roleAssignments": {
+              "copy": {
+                "name": "registry_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_replications": {
+              "copy": {
+                "name": "registry_replications",
+                "count": "[length(coalesce(parameters('replications'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
+                  },
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
+                  },
+                  "regionEndpointEnabled": {
+                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+                  },
+                  "zoneRedundancy": {
+                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "13769087012819677314"
+                    },
+                    "name": "Azure Container Registry (ACR) Replications",
+                    "description": "This module deploys an Azure Container Registry (ACR) Replication.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the replication."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "regionEndpointEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                      }
+                    },
+                    "zoneRedundancy": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "replication": {
+                      "type": "Microsoft.ContainerRegistry/registries/replications",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
+                        "zoneRedundancy": "[parameters('zoneRedundancy')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the replication."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the replication."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the replication was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('replication', '2023-06-01-preview', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_cacheRules": {
+              "copy": {
+                "name": "registry_cacheRules",
+                "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "sourceRepository": {
+                    "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
+                  },
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name'), replace(replace(coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository, '/', '-'), '.', '-'))]"
+                  },
+                  "targetRepository": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                  },
+                  "credentialSetResourceId": {
+                    "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "9456138761658214484"
+                    },
+                    "name": "Container Registries Cache",
+                    "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache)).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-')]",
+                      "metadata": {
+                        "description": "Optional. The name of the cache rule. Will be dereived from the source repository name if not defined."
+                      }
+                    },
+                    "sourceRepository": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Source repository pulled from upstream."
+                      }
+                    },
+                    "targetRepository": {
+                      "type": "string",
+                      "defaultValue": "[parameters('sourceRepository')]",
+                      "metadata": {
+                        "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                      }
+                    },
+                    "credentialSetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "cacheRule": {
+                      "type": "Microsoft.ContainerRegistry/registries/cacheRules",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "properties": {
+                        "sourceRepository": "[parameters('sourceRepository')]",
+                        "targetRepository": "[parameters('targetRepository')]",
+                        "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
+                      },
+                      "dependsOn": [
+                        "registry"
                       ]
                     }
                   },
@@ -7411,50 +22806,299 @@
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the deployed file share service."
+                        "description": "The Name of the Cache Rule."
                       },
-                      "value": "[variables('name')]"
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Cache Rule."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Cache Rule."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_webhooks": {
+              "copy": {
+                "name": "registry_webhooks",
+                "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
+                  },
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                  },
+                  "action": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action'), createArray('chart_delete', 'chart_push', 'delete', 'push', 'quarantine'))]"
+                  },
+                  "customHeaders": {
+                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
+                  },
+                  "scope": {
+                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
+                  },
+                  "status": {
+                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
+                  },
+                  "serviceUri": {
+                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "708950816969162319"
+                    },
+                    "name": "Azure Container Registry (ACR) Webhooks",
+                    "description": "This module deploys an Azure Container Registry (ACR) Webhook.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
+                      "minLength": 5,
+                      "maxLength": 50,
+                      "metadata": {
+                        "description": "Optional. The name of the registry webhook."
+                      }
+                    },
+                    "serviceUri": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The service URI for the webhook to post notifications."
+                      }
+                    },
+                    "status": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The status of the webhook at the time the operation was called."
+                      }
+                    },
+                    "action": {
+                      "type": "array",
+                      "defaultValue": [
+                        "chart_delete",
+                        "chart_push",
+                        "delete",
+                        "push",
+                        "quarantine"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "customHeaders": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom headers that will be added to the webhook notifications."
+                      }
+                    },
+                    "scope": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "webhook": {
+                      "type": "Microsoft.ContainerRegistry/registries/webhooks",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "actions": "[parameters('action')]",
+                        "customHeaders": "[parameters('customHeaders')]",
+                        "scope": "[parameters('scope')]",
+                        "serviceUri": "[parameters('serviceUri')]",
+                        "status": "[parameters('status')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the webhook."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the webhook."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Azure container registry."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "actions": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The actions of the webhook."
+                      },
+                      "value": "[reference('webhook').actions]"
+                    },
+                    "status": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The status of the webhook."
+                      },
+                      "value": "[reference('webhook').status]"
                     },
-                    "resourceId": {
+                    "provistioningState": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the deployed file share service."
+                        "description": "The provisioning state of the webhook."
                       },
-                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
+                      "value": "[reference('webhook').provisioningState]"
                     },
-                    "resourceGroupName": {
+                    "location": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group of the deployed file share service."
+                        "description": "The location the resource was deployed into."
                       },
-                      "value": "[resourceGroup().name]"
+                      "value": "[reference('webhook', '2023-06-01-preview', 'full').location]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "storageAccount"
+                "registry"
               ]
             },
-            "storageAccount_tableServices": {
-              "condition": "[not(empty(parameters('tableServices')))]",
+            "registry_privateEndpoints": {
+              "copy": {
+                "name": "registry_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
+              "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "storageAccountName": {
-                    "value": "[parameters('name')]"
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
                   },
-                  "diagnosticSettings": {
-                    "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
                   },
-                  "tables": {
-                    "value": "[tryGet(parameters('tableServices'), 'tables')]"
+                  "enableTelemetry": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroupName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
                   }
                 },
                 "template": {
@@ -7464,128 +23108,247 @@
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "16839054392438941735"
+                      "version": "0.25.53.49325",
+                      "templateHash": "4120048060064073955"
                     },
-                    "name": "Storage Account Table Services",
-                    "description": "This module deploys a Storage Account Table Service.",
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
-                    "diagnosticSettingType": {
+                    "roleAssignmentType": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "properties": {
-                          "name": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
                             "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The name of diagnostic setting."
+                              "description": "Optional. The principal type of the assigned principal ID."
                             }
                           },
-                          "logCategoriesAndGroups": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                  }
-                                },
-                                "categoryGroup": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
+                          "description": {
+                            "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                              "description": "Optional. The description of the role assignment."
                             }
                           },
-                          "metricCategories": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "category": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                  }
-                                },
-                                "enabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                  }
-                                }
-                              }
-                            },
+                          "condition": {
+                            "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                             }
                           },
-                          "logAnalyticsDestinationType": {
+                          "conditionVersion": {
                             "type": "string",
                             "allowedValues": [
-                              "AzureDiagnostics",
-                              "Dedicated"
+                              "2.0"
                             ],
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                              "description": "Optional. Version of the condition."
                             }
                           },
-                          "workspaceResourceId": {
+                          "delegatedManagedIdentityResourceId": {
                             "type": "string",
                             "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "ipConfigurationsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the resource that is unique within a resource group."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "memberName": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateIPAddress": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private endpoint IP configurations."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "manualPrivateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
                             }
-                          },
-                          "storageAccountResourceId": {
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "privateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
                             "type": "string",
-                            "nullable": true,
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Required. The name of the private link service connection."
                             }
                           },
-                          "eventHubAuthorizationRuleResourceId": {
-                            "type": "string",
-                            "nullable": true,
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
                             "metadata": {
-                              "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                              "description": "Required. Properties of private link service connection."
                             }
-                          },
-                          "eventHubName": {
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "customDnsConfigType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "fqdn": {
                             "type": "string",
-                            "nullable": true,
                             "metadata": {
-                              "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                              "description": "Required. Fqdn that resolves to private endpoint IP address."
                             }
                           },
-                          "marketplacePartnerResourceId": {
-                            "type": "string",
-                            "nullable": true,
+                          "ipAddresses": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
                             "metadata": {
-                              "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                              "description": "Required. A list of private IP addresses of the private endpoint."
                             }
                           }
                         }
@@ -7594,95 +23357,206 @@
                     }
                   },
                   "parameters": {
-                    "storageAccountName": {
+                    "name": {
                       "type": "string",
-                      "maxLength": 24,
                       "metadata": {
-                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                        "description": "Required. Name of the private endpoint resource to create."
                       }
                     },
-                    "tables": {
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
                       "type": "array",
-                      "defaultValue": [],
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. tables to create."
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
                       }
                     },
-                    "diagnosticSettings": {
-                      "$ref": "#/definitions/diagnosticSettingType",
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "$ref": "#/definitions/ipConfigurationsType",
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroupName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                      }
+                    },
+                    "privateDnsZoneResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
                       }
                     }
                   },
                   "variables": {
-                    "name": "default"
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
                   },
                   "resources": {
-                    "storageAccount": {
-                      "existing": true,
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('storageAccountName')]"
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
                     },
-                    "tableServices": {
-                      "type": "Microsoft.Storage/storageAccounts/tableServices",
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
                       "apiVersion": "2023-04-01",
-                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                      "properties": {},
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "tableServices_diagnosticSettings": {
-                      "copy": {
-                        "name": "tableServices_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
                       "properties": {
                         "copy": [
                           {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
                             "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
                             }
                           }
                         ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
                       },
                       "dependsOn": [
-                        "tableServices"
+                        "privateEndpoint"
                       ]
                     },
-                    "tableServices_tables": {
+                    "privateEndpoint_roleAssignments": {
                       "copy": {
-                        "name": "tableServices_tables",
-                        "count": "[length(parameters('tables'))]"
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
                       "type": "Microsoft.Resources/deployments",
                       "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
                       "properties": {
                         "expressionEvaluationOptions": {
                           "scope": "inner"
@@ -7690,199 +23564,94 @@
                         "mode": "Incremental",
                         "parameters": {
                           "name": {
-                            "value": "[parameters('tables')[copyIndex()].name]"
+                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
                           },
-                          "storageAccountName": {
-                            "value": "[parameters('storageAccountName')]"
+                          "privateDNSResourceIds": {
+                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
                           },
-                          "roleAssignments": {
-                            "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
                           }
                         },
                         "template": {
                           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
                           "contentVersion": "1.0.0.0",
                           "metadata": {
                             "_generator": {
                               "name": "bicep",
-                              "version": "0.28.1.47646",
-                              "templateHash": "3177845984945141330"
+                              "version": "0.25.53.49325",
+                              "templateHash": "11244630631275470040"
                             },
-                            "name": "Storage Account Table",
-                            "description": "This module deploys a Storage Account Table.",
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                             "owner": "Azure/module-maintainers"
                           },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "array",
-                              "items": {
-                                "type": "object",
-                                "properties": {
-                                  "roleDefinitionIdOrName": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                    }
-                                  },
-                                  "principalId": {
-                                    "type": "string",
-                                    "metadata": {
-                                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                    }
-                                  },
-                                  "principalType": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Device",
-                                      "ForeignGroup",
-                                      "Group",
-                                      "ServicePrincipal",
-                                      "User"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The principal type of the assigned principal ID."
-                                    }
-                                  },
-                                  "description": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The description of the role assignment."
-                                    }
-                                  },
-                                  "condition": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                    }
-                                  },
-                                  "conditionVersion": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "2.0"
-                                    ],
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. Version of the condition."
-                                    }
-                                  },
-                                  "delegatedManagedIdentityResourceId": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                    }
-                                  }
-                                }
-                              },
-                              "nullable": true
-                            }
-                          },
                           "parameters": {
-                            "storageAccountName": {
+                            "privateEndpointName": {
                               "type": "string",
-                              "maxLength": 24,
                               "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                               }
                             },
-                            "roleAssignments": {
-                              "$ref": "#/definitions/roleAssignmentType",
+                            "privateDNSResourceIds": {
+                              "type": "array",
+                              "minLength": 1,
+                              "maxLength": 5,
                               "metadata": {
-                                "description": "Optional. Array of role assignments to create."
+                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
                               }
                             },
                             "name": {
                               "type": "string",
+                              "defaultValue": "default",
                               "metadata": {
-                                "description": "Required. Name of the table."
+                                "description": "Optional. The name of the private DNS zone group."
                               }
                             }
                           },
                           "variables": {
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                              "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
-                              "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
-                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                            }
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigs",
+                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                "input": {
+                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                  }
+                                }
+                              }
+                            ]
                           },
-                          "resources": {
-                            "storageAccount::tableServices": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts/tableServices",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
-                              "dependsOn": [
-                                "storageAccount"
-                              ]
-                            },
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2023-04-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "table": {
-                              "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                               "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                              "dependsOn": [
-                                "storageAccount::tableServices"
-                              ]
-                            },
-                            "table_roleAssignments": {
-                              "copy": {
-                                "name": "table_roleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                               "properties": {
-                                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "table"
-                              ]
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                              }
                             }
-                          },
+                          ],
                           "outputs": {
                             "name": {
                               "type": "string",
                               "metadata": {
-                                "description": "The name of the deployed file share service."
+                                "description": "The name of the private endpoint DNS zone group."
                               },
                               "value": "[parameters('name')]"
                             },
                             "resourceId": {
                               "type": "string",
                               "metadata": {
-                                "description": "The resource ID of the deployed file share service."
+                                "description": "The resource ID of the private endpoint DNS zone group."
                               },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
                             },
                             "resourceGroupName": {
                               "type": "string",
                               "metadata": {
-                                "description": "The resource group of the deployed file share service."
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
                               },
                               "value": "[resourceGroup().name]"
                             }
@@ -7890,101 +23659,109 @@
                         }
                       },
                       "dependsOn": [
-                        "storageAccount"
+                        "privateEndpoint"
                       ]
                     }
                   },
                   "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the deployed table service."
+                        "description": "The name of the private endpoint."
                       },
-                      "value": "[variables('name')]"
+                      "value": "[parameters('name')]"
                     },
-                    "resourceId": {
+                    "location": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the deployed table service."
+                        "description": "The location the resource was deployed into."
                       },
-                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
+                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
                     },
-                    "resourceGroupName": {
+                    "groupId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group of the deployed table service."
+                        "description": "The group Id for the private endpoint Group."
                       },
-                      "value": "[resourceGroup().name]"
+                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "storageAccount"
+                "registry"
               ]
             }
           },
           "outputs": {
-            "resourceId": {
+            "name": {
               "type": "string",
               "metadata": {
-                "description": "The resource ID of the deployed storage account."
+                "description": "The Name of the Azure container registry."
               },
-              "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              "value": "[parameters('name')]"
             },
-            "name": {
+            "loginServer": {
               "type": "string",
               "metadata": {
-                "description": "The name of the deployed storage account."
+                "description": "The reference to the Azure container registry."
               },
-              "value": "[parameters('name')]"
+              "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2019-05-01').loginServer]"
             },
             "resourceGroupName": {
               "type": "string",
               "metadata": {
-                "description": "The resource group of the deployed storage account."
+                "description": "The name of the Azure container registry."
               },
               "value": "[resourceGroup().name]"
             },
-            "primaryBlobEndpoint": {
+            "resourceId": {
               "type": "string",
               "metadata": {
-                "description": "The primary blob endpoint reference if blob services are deployed."
+                "description": "The resource ID of the Azure container registry."
               },
-              "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
+              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
             },
             "systemAssignedMIPrincipalId": {
               "type": "string",
               "metadata": {
                 "description": "The principal ID of the system assigned identity."
               },
-              "value": "[coalesce(tryGet(tryGet(reference('storageAccount', '2022-09-01', 'full'), 'identity'), 'principalId'), '')]"
+              "value": "[coalesce(tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId'), '')]"
             },
             "location": {
               "type": "string",
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('storageAccount', '2022-09-01', 'full').location]"
-            },
-            "serviceEndpoints": {
-              "type": "object",
-              "metadata": {
-                "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
-              },
-              "value": "[reference('storageAccount').primaryEndpoints]"
+              "value": "[reference('registry', '2023-06-01-preview', 'full').location]"
             }
           }
         }
       },
       "dependsOn": [
-        "managedIdentity"
+        "managedIdentityHub",
+        "managedIdentityProject"
       ]
     },
-    "containerRegistry": {
+    "applicationInsights": {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-container-registry', uniqueString(deployment().name, parameters('location')))]",
+      "name": "[format('{0}-appi', uniqueString(deployment().name, parameters('location')))]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
@@ -7992,38 +23769,31 @@
         "mode": "Incremental",
         "parameters": {
           "name": {
-            "value": "[coalesce(tryGet(parameters('containerRegistrySettings'), 'name'), format('cr{0}', parameters('name')))]"
-          },
-          "acrSku": {
-            "value": "Premium"
+            "value": "[coalesce(tryGet(parameters('applicationInsightsConfiguration'), 'name'), format('appi-{0}', parameters('name')))]"
           },
           "location": {
             "value": "[parameters('location')]"
           },
+          "kind": {
+            "value": "web"
+          },
           "enableTelemetry": {
             "value": "[parameters('enableTelemetry')]"
           },
-          "publicNetworkAccess": {
-            "value": "Disabled"
-          },
-          "networkRuleBypassOptions": {
-            "value": "AzureServices"
-          },
-          "zoneRedundancy": {
-            "value": "Enabled"
-          },
-          "trustPolicyStatus": {
-            "value": "[coalesce(tryGet(parameters('containerRegistrySettings'), 'trustPolicyStatus'), 'enabled')]"
+          "workspaceResourceId": {
+            "value": "[resourceId('Microsoft.OperationalInsights/workspaces', coalesce(tryGet(parameters('logAnalyticsConfiguration'), 'name'), format('log-{0}', parameters('name'))))]"
           },
           "roleAssignments": {
             "value": [
               {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Contributor"
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
               },
               {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "AcrPull"
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
               }
             ]
           },
@@ -8039,318 +23809,73 @@
             "_generator": {
               "name": "bicep",
               "version": "0.28.1.47646",
-              "templateHash": "4907495916128135857"
+              "templateHash": "15992072010754675807"
             },
-            "name": "Azure Container Registries (ACR)",
-            "description": "This module deploys an Azure Container Registry (ACR).",
+            "name": "Application Insights",
+            "description": "This component deploys an Application Insights instance.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
-            "managedIdentitiesType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource."
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "nullable": true
-            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
                 "type": "object",
-                "properties": {
-                  "roleDefinitionIdOrName": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                    }
-                  },
-                  "principalId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                    }
-                  },
-                  "principalType": {
-                    "type": "string",
-                    "allowedValues": [
-                      "Device",
-                      "ForeignGroup",
-                      "Group",
-                      "ServicePrincipal",
-                      "User"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The principal type of the assigned principal ID."
-                    }
-                  },
-                  "description": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The description of the role assignment."
-                    }
-                  },
-                  "condition": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                    }
-                  },
-                  "conditionVersion": {
-                    "type": "string",
-                    "allowedValues": [
-                      "2.0"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Version of the condition."
-                    }
-                  },
-                  "delegatedManagedIdentityResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "privateEndpointType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private endpoint."
-                    }
-                  },
-                  "location": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The location to deploy the private endpoint to."
-                    }
-                  },
-                  "privateLinkServiceConnectionName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private link connection to create."
-                    }
-                  },
-                  "service": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
-                    }
-                  },
-                  "subnetResourceId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                    }
-                  },
-                  "privateDnsZoneGroupName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-                    }
-                  },
-                  "privateDnsZoneResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
-                    }
-                  },
-                  "isManualConnection": {
-                    "type": "bool",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. If Manual Private Link Connection is required."
-                    }
-                  },
-                  "manualConnectionRequestMessage": {
+                "properties": {
+                  "roleDefinitionIdOrName": {
                     "type": "string",
-                    "nullable": true,
-                    "maxLength": 140,
-                    "metadata": {
-                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                    }
-                  },
-                  "customDnsConfigs": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Required. Fqdn that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
                     "metadata": {
-                      "description": "Optional. Custom DNS configurations."
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                     }
                   },
-                  "ipConfigurations": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      }
-                    },
-                    "nullable": true,
+                  "principalId": {
+                    "type": "string",
                     "metadata": {
-                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                     }
                   },
-                  "applicationSecurityGroupResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      "description": "Optional. The principal type of the assigned principal ID."
                     }
                   },
-                  "customNetworkInterfaceName": {
+                  "description": {
                     "type": "string",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                    }
-                  },
-                  "lock": {
-                    "$ref": "#/definitions/lockType",
-                    "metadata": {
-                      "description": "Optional. Specify the type of lock."
-                    }
-                  },
-                  "roleAssignments": {
-                    "$ref": "#/definitions/roleAssignmentType",
-                    "metadata": {
-                      "description": "Optional. Array of role assignments to create."
+                      "description": "Optional. The description of the role assignment."
                     }
                   },
-                  "tags": {
-                    "type": "object",
+                  "condition": {
+                    "type": "string",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                     }
                   },
-                  "enableTelemetry": {
-                    "type": "bool",
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Enable/Disable usage telemetry for module."
+                      "description": "Optional. Version of the condition."
                     }
                   },
-                  "resourceGroupName": {
+                  "delegatedManagedIdentityResourceId": {
                     "type": "string",
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
                     }
                   }
                 }
@@ -8476,61 +24001,121 @@
                 }
               },
               "nullable": true
-            },
-            "customerManagedKeyType": {
-              "type": "object",
-              "properties": {
-                "keyVaultResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                  }
-                },
-                "keyName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the customer managed key to use for encryption."
-                  }
-                },
-                "keyVersion": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
-                  }
-                },
-                "userAssignedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                  }
-                }
-              },
-              "nullable": true
             }
           },
           "parameters": {
             "name": {
               "type": "string",
-              "minLength": 5,
-              "maxLength": 50,
               "metadata": {
-                "description": "Required. Name of your Azure Container Registry."
+                "description": "Required. Name of the Application Insights."
+              }
+            },
+            "applicationType": {
+              "type": "string",
+              "defaultValue": "web",
+              "allowedValues": [
+                "web",
+                "other"
+              ],
+              "metadata": {
+                "description": "Optional. Application type."
+              }
+            },
+            "workspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
+              }
+            },
+            "disableIpMasking": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Disable IP masking. Default value is set to true."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
+              }
+            },
+            "forceCustomerStorageForProfiler": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Force users to create their own storage account for profiler and debugger."
+              }
+            },
+            "linkedStorageAccountResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Linked storage account resource ID."
+              }
+            },
+            "publicNetworkAccessForIngestion": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
+              }
+            },
+            "publicNetworkAccessForQuery": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "allowedValues": [
+                30,
+                60,
+                90,
+                120,
+                180,
+                270,
+                365,
+                550,
+                730
+              ],
+              "metadata": {
+                "description": "Optional. Retention period in days."
+              }
+            },
+            "samplingPercentage": {
+              "type": "int",
+              "defaultValue": 100,
+              "minValue": 0,
+              "maxValue": 100,
+              "metadata": {
+                "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
               }
             },
-            "acrAdminUserEnabled": {
-              "type": "bool",
-              "defaultValue": false,
+            "kind": {
+              "type": "string",
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. Enable admin user that have push / pull permission to the registry."
+                "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
               }
             },
             "location": {
               "type": "string",
               "defaultValue": "[resourceGroup().location]",
               "metadata": {
-                "description": "Optional. Location for all resources."
+                "description": "Optional. Location for all Resources."
               }
             },
             "roleAssignments": {
@@ -8539,1211 +24124,1613 @@
                 "description": "Optional. Array of role assignments to create."
               }
             },
-            "acrSku": {
-              "type": "string",
-              "defaultValue": "Basic",
-              "allowedValues": [
-                "Basic",
-                "Premium",
-                "Standard"
-              ],
+            "tags": {
+              "type": "object",
+              "nullable": true,
               "metadata": {
-                "description": "Optional. Tier of your Azure container registry."
+                "description": "Optional. Tags of the resource."
               }
             },
-            "exportPolicyStatus": {
-              "type": "string",
-              "defaultValue": "disabled",
-              "allowedValues": [
-                "disabled",
-                "enabled"
-              ],
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
               "metadata": {
-                "description": "Optional. The value that indicates whether the export policy is enabled or not."
+                "description": "Optional. Enable/Disable usage telemetry for module."
               }
             },
-            "quarantinePolicyStatus": {
-              "type": "string",
-              "defaultValue": "disabled",
-              "allowedValues": [
-                "disabled",
-                "enabled"
-              ],
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
               "metadata": {
-                "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                "description": "Optional. The diagnostic settings of the service."
               }
-            },
-            "trustPolicyStatus": {
-              "type": "string",
-              "defaultValue": "disabled",
-              "allowedValues": [
-                "disabled",
-                "enabled"
-              ],
-              "metadata": {
-                "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+            }
+          },
+          "variables": {
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
               }
             },
-            "retentionPolicyStatus": {
-              "type": "string",
-              "defaultValue": "enabled",
-              "allowedValues": [
-                "disabled",
-                "enabled"
-              ],
-              "metadata": {
-                "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+            "appInsights": {
+              "type": "Microsoft.Insights/components",
+              "apiVersion": "2020-02-02",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "properties": {
+                "Application_Type": "[parameters('applicationType')]",
+                "DisableIpMasking": "[parameters('disableIpMasking')]",
+                "DisableLocalAuth": "[parameters('disableLocalAuth')]",
+                "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
+                "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                "RetentionInDays": "[parameters('retentionInDays')]",
+                "SamplingPercentage": "[parameters('samplingPercentage')]"
               }
             },
-            "retentionPolicyDays": {
-              "type": "int",
-              "defaultValue": 15,
-              "metadata": {
-                "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
-              }
+            "appInsights_roleAssignments": {
+              "copy": {
+                "name": "appInsights_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
             },
-            "azureADAuthenticationAsArmPolicyStatus": {
+            "appInsights_diagnosticSettings": {
+              "copy": {
+                "name": "appInsights_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
+            },
+            "linkedStorageAccount": {
+              "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appInsightsName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[parameters('linkedStorageAccountResourceId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.28.1.47646",
+                      "templateHash": "11213930862679606021"
+                    },
+                    "name": "Application Insights Linked Storage Account",
+                    "description": "This component deploys an Application Insights Linked Storage Account.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "appInsightsName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Linked storage account resource ID."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "microsoft.insights/components/linkedStorageAccounts",
+                      "apiVersion": "2020-03-01-preview",
+                      "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
+                      "properties": {
+                        "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Linked Storage Account."
+                      },
+                      "value": "ServiceProfiler"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Linked Storage Account."
+                      },
+                      "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the agent pool was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "appInsights"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
               "type": "string",
-              "defaultValue": "enabled",
-              "allowedValues": [
-                "disabled",
-                "enabled"
-              ],
               "metadata": {
-                "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registr is enabled or not. Default is enabled."
-              }
+                "description": "The name of the application insights component."
+              },
+              "value": "[parameters('name')]"
             },
-            "softDeletePolicyStatus": {
+            "resourceId": {
               "type": "string",
-              "defaultValue": "disabled",
-              "allowedValues": [
-                "disabled",
-                "enabled"
-              ],
               "metadata": {
-                "description": "Optional. Soft Delete policy status. Default is disabled."
-              }
-            },
-            "softDeletePolicyDays": {
-              "type": "int",
-              "defaultValue": 7,
-              "metadata": {
-                "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
-              }
-            },
-            "dataEndpointEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
-              }
+                "description": "The resource ID of the application insights component."
+              },
+              "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
             },
-            "publicNetworkAccess": {
+            "resourceGroupName": {
               "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
               "metadata": {
-                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
-              }
+                "description": "The resource group the application insights component was deployed into."
+              },
+              "value": "[resourceGroup().name]"
             },
-            "networkRuleBypassOptions": {
+            "applicationId": {
               "type": "string",
-              "defaultValue": "AzureServices",
-              "allowedValues": [
-                "AzureServices",
-                "None"
-              ],
               "metadata": {
-                "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
-              }
+                "description": "The application ID of the application insights component."
+              },
+              "value": "[reference('appInsights').AppId]"
             },
-            "networkRuleSetDefaultAction": {
+            "location": {
               "type": "string",
-              "defaultValue": "Deny",
-              "allowedValues": [
-                "Allow",
-                "Deny"
-              ],
-              "metadata": {
-                "description": "Optional. The default action of allow or deny when no other rules match."
-              }
-            },
-            "networkRuleSetIpRules": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'."
-              }
-            },
-            "privateEndpoints": {
-              "$ref": "#/definitions/privateEndpointType",
               "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
-              }
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('appInsights', '2020-02-02', 'full').location]"
             },
-            "zoneRedundancy": {
+            "instrumentationKey": {
               "type": "string",
-              "defaultValue": "Disabled",
-              "allowedValues": [
-                "Disabled",
-                "Enabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
-              }
-            },
-            "replications": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. All replications to create."
-              }
-            },
-            "webhooks": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. All webhooks to create."
-              }
-            },
-            "lock": {
-              "$ref": "#/definitions/lockType",
               "metadata": {
-                "description": "Optional. The lock settings of the service."
-              }
+                "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+              },
+              "value": "[reference('appInsights').InstrumentationKey]"
             },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentitiesType",
+            "connectionString": {
+              "type": "string",
               "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
+                "description": "Application Insights Connection String."
+              },
+              "value": "[reference('appInsights').ConnectionString]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalyticsWorkspace",
+        "managedIdentityHub",
+        "managedIdentityProject"
+      ]
+    },
+    "workspaceHub": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-hub', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(tryGet(parameters('workspaceConfiguration'), 'name'), format('hub-{0}', parameters('name')))]"
+          },
+          "sku": {
+            "value": "Standard"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "kind": {
+            "value": "Hub"
+          },
+          "associatedApplicationInsightsResourceId": {
+            "value": "[reference('applicationInsights').outputs.resourceId.value]"
+          },
+          "associatedKeyVaultResourceId": {
+            "value": "[reference('keyVault').outputs.resourceId.value]"
+          },
+          "associatedStorageAccountResourceId": {
+            "value": "[reference('storageAccount').outputs.resourceId.value]"
+          },
+          "associatedContainerRegistryResourceId": {
+            "value": "[reference('containerRegistry').outputs.resourceId.value]"
+          },
+          "workspaceHubConfig": {
+            "value": {
+              "defaultWorkspaceResourceGroup": "[resourceGroup().id]"
+            }
+          },
+          "managedIdentities": {
+            "value": {
+              "userAssignedResourceIds": [
+                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentityConfiguration'), 'hubName'), format('id-hub-{0}', parameters('name'))))]"
+              ]
+            }
+          },
+          "primaryUserAssignedIdentity": {
+            "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentityConfiguration'), 'hubName'), format('id-hub-{0}', parameters('name'))))]"
+          },
+          "computes": {
+            "value": "[tryGet(parameters('workspaceConfiguration'), 'computes')]"
+          },
+          "managedNetworkSettings": {
+            "value": {
+              "isolationMode": "[coalesce(tryGet(parameters('workspaceConfiguration'), 'networkIsolationMode'), 'AllowInternetOutbound')]",
+              "outboundRules": "[tryGet(parameters('workspaceConfiguration'), 'networkOutboundRules')]"
+            }
+          },
+          "privateEndpoints": "[if(not(equals(variables('subnetResourceId'), null())), createObject('value', createArray(createObject('name', format('pep-{0}-{1}', variables('mlTargetSubResource'), parameters('name')), 'customNetworkInterfaceName', format('nic-{0}-{1}', variables('mlTargetSubResource'), parameters('name')), 'service', variables('mlTargetSubResource'), 'subnetResourceId', coalesce(variables('subnetResourceId'), ''), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', map(objectKeys(variables('mlPrivateDnsZones')), lambda('zone', createObject('name', replace(lambdaVariables('zone'), '.', '-'), 'privateDnsZoneResourceId', resourceId('Microsoft.Network/privateDnsZones', lambdaVariables('zone'))))))))), createObject('value', null()))]",
+          "systemDatastoresAuthMode": {
+            "value": "identity"
+          },
+          "roleAssignments": {
+            "value": [
+              {
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
               }
+            ]
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "1726366914846644834"
             },
-            "tags": {
+            "name": "Machine Learning Services Workspaces",
+            "description": "This module deploys a Machine Learning Services Workspace.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
               "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "diagnosticSettings": {
-              "$ref": "#/definitions/diagnosticSettingType",
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "anonymousPullEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource. Must be false if `primaryUserAssignedIdentity` is provided."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
               }
             },
-            "customerManagedKey": {
-              "$ref": "#/definitions/customerManagedKeyType",
-              "metadata": {
-                "description": "Optional. The customer managed key definition."
-              }
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
             },
-            "cacheRules": {
+            "roleAssignmentType": {
               "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Array of Cache Rules. Note: This is a preview feature ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache#cache-for-acr-preview))."
-              }
-            }
-          },
-          "variables": {
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "builtInRoleNames": {
-              "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
-              "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
-              "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
-              "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
-              "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
-              "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "cMKKeyVault::cMKKey": {
-              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults/keys",
-              "apiVersion": "2023-02-01",
-              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
-              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
-              "dependsOn": [
-                "cMKKeyVault"
-              ]
+              "items": {
+                "type": "object",
+                "properties": {
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
             },
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+            "privateEndpointType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private endpoint."
+                    }
+                  },
+                  "location": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The location to deploy the private endpoint to."
+                    }
+                  },
+                  "privateLinkServiceConnectionName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private link connection to create."
+                    }
+                  },
+                  "service": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                    }
+                  },
+                  "subnetResourceId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                    }
+                  },
+                  "privateDnsZoneGroup": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the Private DNS Zone Group."
+                        }
+                      },
+                      "privateDnsZoneGroupConfigs": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group config."
+                              }
+                            },
+                            "privateDnsZoneResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource id of the private DNS zone."
+                              }
+                            }
+                          }
+                        },
+                        "metadata": {
+                          "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                    }
+                  },
+                  "isManualConnection": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. If Manual Private Link Connection is required."
+                    }
+                  },
+                  "manualConnectionRequestMessage": {
+                    "type": "string",
+                    "nullable": true,
+                    "maxLength": 140,
+                    "metadata": {
+                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                    }
+                  },
+                  "customDnsConfigs": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Required. Fqdn that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Custom DNS configurations."
                     }
-                  }
-                }
-              }
-            },
-            "cMKKeyVault": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults",
-              "apiVersion": "2023-02-01",
-              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
-              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
-            },
-            "cMKUserAssignedIdentity": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-              "apiVersion": "2023-01-31",
-              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
-              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
-              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
-            },
-            "registry": {
-              "type": "Microsoft.ContainerRegistry/registries",
-              "apiVersion": "2023-06-01-preview",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "identity": "[variables('identity')]",
-              "tags": "[parameters('tags')]",
-              "sku": {
-                "name": "[parameters('acrSku')]"
-              },
-              "properties": {
-                "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
-                "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
-                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), reference('cMKKeyVault::cMKKey').keyUriWithVersion))), null())]",
-                "policies": {
-                  "azureADAuthenticationAsArmPolicy": {
-                    "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
                   },
-                  "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
-                  "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
-                  "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
-                  "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
-                  "softDeletePolicy": {
-                    "retentionDays": "[parameters('softDeletePolicyDays')]",
-                    "status": "[parameters('softDeletePolicyStatus')]"
-                  }
-                },
-                "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
-                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
-                "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
-                "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]",
-                "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
-              },
-              "dependsOn": [
-                "cMKKeyVault",
-                "cMKUserAssignedIdentity"
-              ]
-            },
-            "registry_lock": {
-              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-              "type": "Microsoft.Authorization/locks",
-              "apiVersion": "2020-05-01",
-              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-              "properties": {
-                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-              },
-              "dependsOn": [
-                "registry"
-              ]
-            },
-            "registry_diagnosticSettings": {
-              "copy": {
-                "name": "registry_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
+                  "ipConfigurations": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
                     }
                   },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                  "applicationSecurityGroupResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                    }
+                  },
+                  "customNetworkInterfaceName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                    }
+                  },
+                  "lock": {
+                    "$ref": "#/definitions/lockType",
+                    "metadata": {
+                      "description": "Optional. Specify the type of lock."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                    }
+                  },
+                  "enableTelemetry": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Enable/Disable usage telemetry for module."
+                    }
+                  },
+                  "resourceGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
                     }
                   }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                }
               },
-              "dependsOn": [
-                "registry"
-              ]
+              "nullable": true
             },
-            "registry_roleAssignments": {
-              "copy": {
-                "name": "registry_roleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+            "featureStoreSettingType": {
+              "type": "object",
               "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                "computeRuntime": {
+                  "type": "object",
+                  "properties": {
+                    "sparkRuntimeVersion": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The spark runtime version."
+                      }
+                    }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Compute runtime config for feature store type workspace."
+                  }
+                },
+                "offlineStoreConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The offline store connection name."
+                  }
+                },
+                "onlineStoreConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The online store connection name."
+                  }
+                }
               },
-              "dependsOn": [
-                "registry"
-              ]
+              "nullable": true
             },
-            "registry_replications": {
-              "copy": {
-                "name": "registry_replications",
-                "count": "[length(coalesce(parameters('replications'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
-                  },
-                  "registryName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
-                  },
-                  "regionEndpointEnabled": {
-                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+            "OutboundRuleType": {
+              "type": "object",
+              "discriminator": {
+                "propertyName": "type",
+                "mapping": {
+                  "FQDN": {
+                    "$ref": "#/definitions/FqdnOutboundRuleType"
                   },
-                  "zoneRedundancy": {
-                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                  "PrivateEndpoint": {
+                    "$ref": "#/definitions/PrivateEndpointOutboundRule"
                   },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  "ServiceTag": {
+                    "$ref": "#/definitions/ServiceTagOutboundRule"
+                  }
+                }
+              }
+            },
+            "FqdnOutboundRuleType": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "allowedValues": [
+                    "FQDN"
+                  ],
+                  "metadata": {
+                    "description": "Required. Type of a managed network Outbound Rule of a machine learning workspace. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound'."
                   }
                 },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
+                "destination": {
+                  "type": "string",
                   "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "13769087012819677314"
-                    },
-                    "name": "Azure Container Registry (ACR) Replications",
-                    "description": "This module deploys an Azure Container Registry (ACR) Replication.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "parameters": {
-                    "registryName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the replication."
-                      }
-                    },
-                    "location": {
+                    "description": "Required. Fully Qualified Domain Name to allow for outbound traffic."
+                  }
+                },
+                "category": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Dependency",
+                    "Recommended",
+                    "Required",
+                    "UserDefined"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Category of a managed network Outbound Rule of a machine learning workspace."
+                  }
+                }
+              }
+            },
+            "PrivateEndpointOutboundRule": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "allowedValues": [
+                    "PrivateEndpoint"
+                  ],
+                  "metadata": {
+                    "description": "Required. Type of a managed network Outbound Rule of a machine learning workspace. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound' or 'AllowInternetOutbound'."
+                  }
+                },
+                "destination": {
+                  "type": "object",
+                  "properties": {
+                    "serviceResourceId": {
                       "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. Tags of the resource."
+                        "description": "Required. The resource ID of the target resource for the private endpoint."
                       }
                     },
-                    "regionEndpointEnabled": {
+                    "sparkEnabled": {
                       "type": "bool",
-                      "defaultValue": true,
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                        "description": "Optional. Whether the private endpoint can be used by jobs running on Spark."
                       }
                     },
-                    "zoneRedundancy": {
+                    "subresourceTarget": {
                       "type": "string",
-                      "defaultValue": "Disabled",
-                      "allowedValues": [
-                        "Disabled",
-                        "Enabled"
-                      ],
                       "metadata": {
-                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                        "description": "Required. The sub resource to connect for the private endpoint."
                       }
                     }
                   },
-                  "resources": {
-                    "registry": {
-                      "existing": true,
-                      "type": "Microsoft.ContainerRegistry/registries",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[parameters('registryName')]"
-                    },
-                    "replication": {
-                      "type": "Microsoft.ContainerRegistry/registries/replications",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
-                        "zoneRedundancy": "[parameters('zoneRedundancy')]"
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the replication."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
+                  "metadata": {
+                    "description": "Required. Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace."
+                  }
+                },
+                "category": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Dependency",
+                    "Recommended",
+                    "Required",
+                    "UserDefined"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Category of a managed network Outbound Rule of a machine learning workspace."
+                  }
+                }
+              }
+            },
+            "ServiceTagOutboundRule": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "allowedValues": [
+                    "ServiceTag"
+                  ],
+                  "metadata": {
+                    "description": "Required. Type of a managed network Outbound Rule of a machine learning workspace. Only supported when 'isolationMode' is 'AllowOnlyApprovedOutbound'."
+                  }
+                },
+                "destination": {
+                  "type": "object",
+                  "properties": {
+                    "portRanges": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the replication."
-                      },
-                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                        "description": "Required. The name of the service tag to allow."
+                      }
                     },
-                    "resourceGroupName": {
+                    "protocol": {
                       "type": "string",
+                      "allowedValues": [
+                        "*",
+                        "ICMP",
+                        "TCP",
+                        "UDP"
+                      ],
                       "metadata": {
-                        "description": "The name of the resource group the replication was created in."
-                      },
-                      "value": "[resourceGroup().name]"
+                        "description": "Required. The protocol to allow. Provide an asterisk(*) to allow any protocol."
+                      }
                     },
-                    "location": {
+                    "serviceTag": {
                       "type": "string",
                       "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('replication', '2023-06-01-preview', 'full').location]"
+                        "description": "Required. Which ports will be allow traffic by this rule. Provide an asterisk(*) to allow any port."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Service Tag destination for a Service Tag Outbound Rule for the managed network of a machine learning workspace."
+                  }
+                },
+                "category": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Dependency",
+                    "Recommended",
+                    "Required",
+                    "UserDefined"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Category of a managed network Outbound Rule of a machine learning workspace."
+                  }
+                }
+              }
+            },
+            "managedNetworkSettingType": {
+              "type": "object",
+              "properties": {
+                "isolationMode": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AllowInternetOutbound",
+                    "AllowOnlyApprovedOutbound",
+                    "Disabled"
+                  ],
+                  "metadata": {
+                    "description": "Required. Isolation mode for the managed network of a machine learning workspace."
+                  }
+                },
+                "outboundRules": {
+                  "type": "object",
+                  "properties": {},
+                  "additionalProperties": {
+                    "$ref": "#/definitions/OutboundRuleType",
+                    "metadata": {
+                      "description": "Required. The outbound rule. The name of the rule is the object key."
                     }
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Outbound rules for the managed network of a machine learning workspace."
                   }
                 }
               },
-              "dependsOn": [
-                "registry"
-              ]
+              "nullable": true
             },
-            "registry_cacheRules": {
-              "copy": {
-                "name": "registry_cacheRules",
-                "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
-              },
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+            "serverlessComputeSettingType": {
+              "type": "object",
               "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
+                "serverlessComputeCustomSubnet": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of an existing virtual network subnet in which serverless compute nodes should be deployed."
+                  }
                 },
-                "mode": "Incremental",
-                "parameters": {
-                  "registryName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "sourceRepository": {
-                    "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
-                  },
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name'), replace(replace(coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository, '/', '-'), '.', '-'))]"
-                  },
-                  "targetRepository": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                "serverlessComputeNoPublicIP": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The flag to signal if serverless compute nodes deployed in custom vNet would have no public IP addresses for a workspace with private endpoint."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "workspaceHubConfigType": {
+              "type": "object",
+              "properties": {
+                "additionalWorkspaceStorageAccounts": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
                   },
-                  "credentialSetResourceId": {
-                    "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource IDs of additional storage accounts to attach to the workspace."
                   }
                 },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
+                "defaultWorkspaceResourceGroup": {
+                  "type": "string",
+                  "nullable": true,
                   "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "9456138761658214484"
-                    },
-                    "name": "Container Registries Cache",
-                    "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache)).",
-                    "owner": "Azure/module-maintainers"
+                    "description": "Optional. The resource ID of the default resource group for projects created in the workspace hub."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
                   },
-                  "parameters": {
-                    "registryName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the parent registry. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-')]",
-                      "metadata": {
-                        "description": "Optional. The name of the cache rule. Will be dereived from the source repository name if not defined."
-                      }
-                    },
-                    "sourceRepository": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Source repository pulled from upstream."
+                  "logCategoriesAndGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                          }
+                        },
+                        "categoryGroup": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
                       }
                     },
-                    "targetRepository": {
-                      "type": "string",
-                      "defaultValue": "[parameters('sourceRepository')]",
-                      "metadata": {
-                        "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "metricCategories": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
                       }
                     },
-                    "credentialSetResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
-                      }
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
                     }
                   },
-                  "resources": {
-                    "registry": {
-                      "existing": true,
-                      "type": "Microsoft.ContainerRegistry/registries",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[parameters('registryName')]"
-                    },
-                    "cacheRule": {
-                      "type": "Microsoft.ContainerRegistry/registries/cacheRules",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                      "properties": {
-                        "sourceRepository": "[parameters('sourceRepository')]",
-                        "targetRepository": "[parameters('targetRepository')]",
-                        "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
                     }
                   },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The Name of the Cache Rule."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Cache Rule."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Cache Rule."
-                      },
-                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
                     }
                   }
                 }
               },
+              "nullable": true
+            },
+            "customerManagedKeyType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                  }
+                },
+                "keyName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the customer managed key to use for encryption."
+                  }
+                },
+                "keyVersion": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
+                  }
+                },
+                "userAssignedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the machine learning workspace."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "sku": {
+              "type": "string",
+              "allowedValues": [
+                "Free",
+                "Basic",
+                "Standard",
+                "Premium"
+              ],
+              "metadata": {
+                "description": "Required. Specifies the SKU, also referred as 'edition' of the Azure Machine Learning workspace."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "Default",
+              "allowedValues": [
+                "Default",
+                "Project",
+                "Hub",
+                "FeatureStore"
+              ],
+              "metadata": {
+                "description": "Optional. The type of Azure Machine Learning workspace to create."
+              }
+            },
+            "associatedStorageAccountResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. The resource ID of the associated Storage Account. Required if 'kind' is 'Default', 'FeatureStore' or 'Hub'."
+              }
+            },
+            "associatedKeyVaultResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. The resource ID of the associated Key Vault. Required if 'kind' is 'Default', 'FeatureStore' or 'Hub'."
+              }
+            },
+            "associatedApplicationInsightsResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. The resource ID of the associated Application Insights. Required if 'kind' is 'Default' or 'FeatureStore'."
+              }
+            },
+            "associatedContainerRegistryResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The resource ID of the associated Container Registry."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "hbiWorkspace": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service."
+              }
+            },
+            "hubResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. The resource ID of the hub to associate with the workspace. Required if 'kind' is set to 'Project'."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "privateEndpoints": {
+              "$ref": "#/definitions/privateEndpointType",
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "computes": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Computes to create respectively attach to the workspace."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Resource tags."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource. At least one identity type is required."
+              }
+            },
+            "featureStoreSettings": {
+              "$ref": "#/definitions/featureStoreSettingType",
+              "metadata": {
+                "description": "Conditional. Settings for feature store type workspaces. Required if 'kind' is set to 'FeatureStore'."
+              }
+            },
+            "managedNetworkSettings": {
+              "$ref": "#/definitions/managedNetworkSettingType",
+              "metadata": {
+                "description": "Optional. Managed Network settings for a machine learning workspace."
+              }
+            },
+            "serverlessComputeSettings": {
+              "$ref": "#/definitions/serverlessComputeSettingType",
+              "metadata": {
+                "description": "Optional. Settings for serverless compute created in the workspace."
+              }
+            },
+            "systemDatastoresAuthMode": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "accessKey",
+                "identity"
+              ],
+              "metadata": {
+                "description": "Optional. The authentication mode used by the workspace when connecting to the default storage account."
+              }
+            },
+            "workspaceHubConfig": {
+              "$ref": "#/definitions/workspaceHubConfigType",
+              "metadata": {
+                "description": "Optional. Configuration for workspace hub settings."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "description": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The description of this workspace."
+              }
+            },
+            "discoveryUrl": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. URL for the discovery service to identify regional endpoints for machine learning experimentation services."
+              }
+            },
+            "customerManagedKey": {
+              "$ref": "#/definitions/customerManagedKeyType",
+              "metadata": {
+                "description": "Optional. The customer managed key definition."
+              }
+            },
+            "imageBuildCompute": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The compute name for image build."
+              }
+            },
+            "primaryUserAssignedIdentity": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Conditional. The user assigned identity resource ID that represents the workspace identity. Required if 'userAssignedIdentities' is not empty and may not be used if 'systemAssignedIdentity' is enabled."
+              }
+            },
+            "serviceManagedResourcesSettings": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The service managed resource settings."
+              }
+            },
+            "sharedPrivateLinkResources": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The list of shared private link resources in this workspace. Note: This property is not idempotent."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled."
+              }
+            }
+          },
+          "variables": {
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "AzureML Compute Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e503ece1-11d0-4e8e-8e2c-7a6c3bf38815')]",
+              "AzureML Data Scientist": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f6c7c914-8db3-469d-8ca1-694a8f32e121')]",
+              "AzureML Metrics Writer (preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '635dd51f-9968-44d3-b7fb-6d9a6bd613ae')]",
+              "AzureML Registry User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1823dd4f-9b8c-4ab6-ab4e-7397a3684615')]",
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "cMKKeyVault::cMKKey": {
+              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults/keys",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
               "dependsOn": [
-                "registry"
+                "cMKKeyVault"
               ]
             },
-            "registry_webhooks": {
-              "copy": {
-                "name": "registry_webhooks",
-                "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
-              },
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.machinelearningservices-workspace.{0}.{1}', replace('0.5.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
                 "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
-                  },
-                  "registryName": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
-                  },
-                  "action": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action'), createArray('chart_delete', 'chart_push', 'delete', 'push', 'quarantine'))]"
-                  },
-                  "customHeaders": {
-                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
-                  },
-                  "scope": {
-                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
-                  },
-                  "status": {
-                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
-                  },
-                  "serviceUri": {
-                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
-                  },
-                  "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  }
-                },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "708950816969162319"
-                    },
-                    "name": "Azure Container Registry (ACR) Webhooks",
-                    "description": "This module deploys an Azure Container Registry (ACR) Webhook.",
-                    "owner": "Azure/module-maintainers"
-                  },
-                  "parameters": {
-                    "registryName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                      }
-                    },
-                    "name": {
-                      "type": "string",
-                      "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
-                      "minLength": 5,
-                      "maxLength": 50,
-                      "metadata": {
-                        "description": "Optional. The name of the registry webhook."
-                      }
-                    },
-                    "serviceUri": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The service URI for the webhook to post notifications."
-                      }
-                    },
-                    "status": {
-                      "type": "string",
-                      "defaultValue": "enabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The status of the webhook at the time the operation was called."
-                      }
-                    },
-                    "action": {
-                      "type": "array",
-                      "defaultValue": [
-                        "chart_delete",
-                        "chart_push",
-                        "delete",
-                        "push",
-                        "quarantine"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The list of actions that trigger the webhook to post notifications."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "customHeaders": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom headers that will be added to the webhook notifications."
-                      }
-                    },
-                    "scope": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
-                      }
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
                     }
-                  },
-                  "resources": {
-                    "registry": {
-                      "existing": true,
-                      "type": "Microsoft.ContainerRegistry/registries",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[parameters('registryName')]"
-                    },
-                    "webhook": {
-                      "type": "Microsoft.ContainerRegistry/registries/webhooks",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "actions": "[parameters('action')]",
-                        "customHeaders": "[parameters('customHeaders')]",
-                        "scope": "[parameters('scope')]",
-                        "serviceUri": "[parameters('serviceUri')]",
-                        "status": "[parameters('status')]"
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
+                  }
+                }
+              }
+            },
+            "cMKKeyVault": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
+            },
+            "cMKUserAssignedIdentity": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2023-01-31",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
+            },
+            "workspace": {
+              "type": "Microsoft.MachineLearningServices/workspaces",
+              "apiVersion": "2024-04-01-preview",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('sku')]",
+                "tier": "[parameters('sku')]"
+              },
+              "identity": "[variables('identity')]",
+              "properties": "[union(createObject('friendlyName', parameters('name'), 'storageAccount', parameters('associatedStorageAccountResourceId'), 'keyVault', parameters('associatedKeyVaultResourceId'), 'applicationInsights', parameters('associatedApplicationInsightsResourceId'), 'containerRegistry', parameters('associatedContainerRegistryResourceId'), 'hbiWorkspace', parameters('hbiWorkspace'), 'description', parameters('description'), 'discoveryUrl', parameters('discoveryUrl'), 'encryption', if(not(empty(parameters('customerManagedKey'))), createObject('status', 'Enabled', 'identity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), createObject('userAssignedIdentity', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2], split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/')))), null()), 'keyVaultProperties', createObject('keyVaultArmId', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2], split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]), 'Microsoft.KeyVault/vaults', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))), 'keyIdentifier', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), reference('cMKKeyVault::cMKKey').keyUriWithVersion))), null()), 'imageBuildCompute', parameters('imageBuildCompute'), 'primaryUserAssignedIdentity', parameters('primaryUserAssignedIdentity'), 'systemDatastoresAuthMode', parameters('systemDatastoresAuthMode'), 'publicNetworkAccess', parameters('publicNetworkAccess'), 'serviceManagedResourcesSettings', parameters('serviceManagedResourcesSettings'), 'featureStoreSettings', parameters('featureStoreSettings'), 'hubResourceId', parameters('hubResourceId'), 'managedNetwork', parameters('managedNetworkSettings'), 'serverlessComputeSettings', parameters('serverlessComputeSettings'), 'workspaceHubConfig', parameters('workspaceHubConfig')), if(not(empty(parameters('sharedPrivateLinkResources'))), createObject('sharedPrivateLinkResources', parameters('sharedPrivateLinkResources')), createObject()))]",
+              "kind": "[parameters('kind')]",
+              "dependsOn": [
+                "cMKKeyVault",
+                "cMKUserAssignedIdentity"
+              ]
+            },
+            "workspace_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.MachineLearningServices/workspaces/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "workspace"
+              ]
+            },
+            "workspace_diagnosticSettings": {
+              "copy": {
+                "name": "workspace_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.MachineLearningServices/workspaces/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
                     }
                   },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the webhook."
-                      },
-                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the webhook."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Azure container registry."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "actions": {
-                      "type": "array",
-                      "metadata": {
-                        "description": "The actions of the webhook."
-                      },
-                      "value": "[reference('webhook').actions]"
-                    },
-                    "status": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The status of the webhook."
-                      },
-                      "value": "[reference('webhook').status]"
-                    },
-                    "provistioningState": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The provisioning state of the webhook."
-                      },
-                      "value": "[reference('webhook').provisioningState]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('webhook', '2023-06-01-preview', 'full').location]"
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
                     }
                   }
-                }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
               },
               "dependsOn": [
-                "registry"
+                "workspace"
               ]
             },
-            "registry_privateEndpoints": {
+            "workspace_roleAssignments": {
               "copy": {
-                "name": "registry_privateEndpoints",
-                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                "name": "workspace_roleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.MachineLearningServices/workspaces/{0}', parameters('name'))]",
+              "name": "[guid(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "workspace"
+              ]
+            },
+            "workspace_computes": {
+              "copy": {
+                "name": "workspace_computes",
+                "count": "[length(coalesce(parameters('computes'), createArray()))]"
               },
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
-              "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "name": "[format('{0}-{1}-compute', parameters('name'), coalesce(parameters('computes'), createArray())[copyIndex()].name)]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "name": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
-                  },
-                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
-                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                  "subnetResourceId": {
-                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  "machineLearningWorkspaceName": {
+                    "value": "[parameters('name')]"
                   },
-                  "enableTelemetry": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  "name": {
+                    "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].name]"
                   },
                   "location": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                  },
-                  "lock": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                  },
-                  "privateDnsZoneGroupName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                    "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].location]"
                   },
-                  "privateDnsZoneResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  "sku": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'sku')]"
                   },
-                  "roleAssignments": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  "managedIdentities": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'managedIdentities')]"
                   },
                   "tags": {
-                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                  },
-                  "customDnsConfigs": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'tags')]"
                   },
-                  "ipConfigurations": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  "deployCompute": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'deployCompute')]"
                   },
-                  "applicationSecurityGroupResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  "computeLocation": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'computeLocation')]"
                   },
-                  "customNetworkInterfaceName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "4120048060064073955"
-                    },
-                    "name": "Private Endpoints",
-                    "description": "This module deploys a Private Endpoint.",
-                    "owner": "Azure/module-maintainers"
+                  "description": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'description')]"
                   },
-                  "definitions": {
-                    "roleAssignmentType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "roleDefinitionIdOrName": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                            }
-                          },
-                          "principalId": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                            }
-                          },
-                          "principalType": {
-                            "type": "string",
-                            "allowedValues": [
-                              "Device",
-                              "ForeignGroup",
-                              "Group",
-                              "ServicePrincipal",
-                              "User"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The principal type of the assigned principal ID."
-                            }
-                          },
-                          "description": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The description of the role assignment."
-                            }
-                          },
-                          "condition": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                            }
-                          },
-                          "conditionVersion": {
-                            "type": "string",
-                            "allowedValues": [
-                              "2.0"
-                            ],
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. Version of the condition."
-                            }
-                          },
-                          "delegatedManagedIdentityResourceId": {
-                            "type": "string",
-                            "nullable": true,
-                            "metadata": {
-                              "description": "Optional. The Resource Id of the delegated managed identity resource."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
+                  "disableLocalAuth": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'disableLocalAuth')]"
+                  },
+                  "resourceId": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'resourceId')]"
+                  },
+                  "computeType": {
+                    "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].computeType]"
+                  },
+                  "properties": {
+                    "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'properties')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "8580750401363518569"
                     },
-                    "lockType": {
+                    "name": "Machine Learning Services Workspaces Computes",
+                    "description": "This module deploys a Machine Learning Services Workspaces Compute.\n\nAttaching a compute is not idempotent and will fail in case you try to redeploy over an existing compute in AML (see parameter `deployCompute`).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "managedIdentitiesType": {
                       "type": "object",
                       "properties": {
-                        "name": {
-                          "type": "string",
+                        "systemAssigned": {
+                          "type": "bool",
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Specify the name of lock."
+                            "description": "Optional. Enables system assigned managed identity on the resource."
                           }
                         },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "ipConfigurationsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the resource that is unique within a resource group."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "memberName": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateIPAddress": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private endpoint IP configurations."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "manualPrivateLinkServiceConnectionsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the private link service connection."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupIds": {
-                                "type": "array",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateLinkServiceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of private link service."
-                                }
-                              },
-                              "requestMessage": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private link service connection."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "privateLinkServiceConnectionsType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. The name of the private link service connection."
-                            }
-                          },
-                          "properties": {
-                            "type": "object",
-                            "properties": {
-                              "groupIds": {
-                                "type": "array",
-                                "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                }
-                              },
-                              "privateLinkServiceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of private link service."
-                                }
-                              },
-                              "requestMessage": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                }
-                              }
-                            },
-                            "metadata": {
-                              "description": "Required. Properties of private link service connection."
-                            }
-                          }
-                        }
-                      },
-                      "nullable": true
-                    },
-                    "customDnsConfigType": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "fqdn": {
-                            "type": "string",
-                            "metadata": {
-                              "description": "Required. Fqdn that resolves to private endpoint IP address."
-                            }
-                          },
-                          "ipAddresses": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            },
-                            "metadata": {
-                              "description": "Required. A list of private IP addresses of the private endpoint."
-                            }
+                            "description": "Optional. The resource ID(s) to assign to the resource."
                           }
                         }
                       },
@@ -9751,1046 +25738,997 @@
                     }
                   },
                   "parameters": {
-                    "name": {
+                    "machineLearningWorkspaceName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. Name of the private endpoint resource to create."
+                        "description": "Conditional. The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "subnetResourceId": {
+                    "name": {
                       "type": "string",
+                      "minLength": 2,
+                      "maxLength": 16,
                       "metadata": {
-                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                        "description": "Required. Name of the compute."
                       }
                     },
-                    "applicationSecurityGroupResourceIds": {
-                      "type": "array",
-                      "nullable": true,
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
                       "metadata": {
-                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                        "description": "Optional. Specifies the location of the resource."
                       }
                     },
-                    "customNetworkInterfaceName": {
+                    "sku": {
                       "type": "string",
                       "nullable": true,
+                      "allowedValues": [
+                        "Basic",
+                        "Free",
+                        "Premium",
+                        "Standard"
+                      ],
                       "metadata": {
-                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                      }
-                    },
-                    "ipConfigurations": {
-                      "$ref": "#/definitions/ipConfigurationsType",
-                      "metadata": {
-                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                        "description": "Optional. Specifies the sku, also referred as \"edition\". Required for creating a compute resource."
                       }
                     },
-                    "privateDnsZoneGroupName": {
-                      "type": "string",
+                    "tags": {
+                      "type": "object",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                        "description": "Optional. Contains resource tags defined as key-value pairs. Ignored when attaching a compute resource, i.e. when you provide a resource ID."
                       }
                     },
-                    "privateDnsZoneResourceIds": {
-                      "type": "array",
-                      "nullable": true,
+                    "deployCompute": {
+                      "type": "bool",
+                      "defaultValue": true,
                       "metadata": {
-                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Optional. Flag to specify whether to deploy the compute. Required only for attach (i.e. providing a resource ID), as in this case the operation is not idempotent, i.e. a second deployment will fail. Therefore, this flag needs to be set to \"false\" as long as the compute resource exists."
                       }
                     },
-                    "location": {
+                    "computeLocation": {
                       "type": "string",
                       "defaultValue": "[resourceGroup().location]",
                       "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
+                        "description": "Optional. Location for the underlying compute. Ignored when attaching a compute resource, i.e. when you provide a resource ID."
                       }
                     },
-                    "roleAssignments": {
-                      "$ref": "#/definitions/roleAssignmentType",
+                    "description": {
+                      "type": "string",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. Array of role assignments to create."
+                        "description": "Optional. The description of the Machine Learning compute."
                       }
                     },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": false,
                       "metadata": {
-                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                        "description": "Optional. Opt-out of local authentication and ensure customers can use only MSI and AAD exclusively for authentication."
                       }
                     },
-                    "customDnsConfigs": {
-                      "$ref": "#/definitions/customDnsConfigType",
+                    "resourceId": {
+                      "type": "string",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. Custom DNS configurations."
+                        "description": "Optional. ARM resource ID of the underlying compute."
                       }
                     },
-                    "manualPrivateLinkServiceConnections": {
-                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                    "computeType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "AKS",
+                        "AmlCompute",
+                        "ComputeInstance",
+                        "Databricks",
+                        "DataFactory",
+                        "DataLakeAnalytics",
+                        "HDInsight",
+                        "Kubernetes",
+                        "SynapseSpark",
+                        "VirtualMachine"
+                      ],
                       "metadata": {
-                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                        "description": "Required. Set the object type."
                       }
                     },
-                    "privateLinkServiceConnections": {
-                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                    "properties": {
+                      "type": "object",
+                      "nullable": true,
                       "metadata": {
-                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                        "description": "Optional. The properties of the compute. Will be ignored in case \"resourceId\" is set."
                       }
                     },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentitiesType",
                       "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
+                        "description": "Optional. The managed identity definition for this resource."
                       }
                     }
                   },
                   "variables": {
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                    }
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
                   },
                   "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2023-07-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "privateEndpoint": {
-                      "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2023-04-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "applicationSecurityGroups",
-                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                            "input": {
-                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                            }
-                          }
-                        ],
-                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                        "subnet": {
-                          "id": "[parameters('subnetResourceId')]"
-                        }
-                      }
-                    },
-                    "privateEndpoint_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_roleAssignments": {
-                      "copy": {
-                        "name": "privateEndpoint_roleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
-                      "properties": {
-                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "privateEndpoint"
-                      ]
-                    },
-                    "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                          },
-                          "privateDNSResourceIds": {
-                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
-                          },
-                          "privateEndpointName": {
-                            "value": "[parameters('name')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.25.53.49325",
-                              "templateHash": "11244630631275470040"
-                            },
-                            "name": "Private Endpoint Private DNS Zone Groups",
-                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
-                            "owner": "Azure/module-maintainers"
-                          },
-                          "parameters": {
-                            "privateEndpointName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "privateDNSResourceIds": {
-                              "type": "array",
-                              "minLength": 1,
-                              "maxLength": 5,
-                              "metadata": {
-                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the private DNS zone group."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneConfigs",
-                                "count": "[length(parameters('privateDNSResourceIds'))]",
-                                "input": {
-                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
-                                  "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
-                                  }
-                                }
-                              }
-                            ]
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2023-04-01",
-                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                              "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint DNS zone group."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint DNS zone group."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint DNS zone group was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
+                    "machineLearningWorkspace": {
+                      "existing": true,
+                      "type": "Microsoft.MachineLearningServices/workspaces",
+                      "apiVersion": "2022-10-01",
+                      "name": "[parameters('machineLearningWorkspaceName')]"
+                    },
+                    "compute": {
+                      "condition": "[equals(parameters('deployCompute'), true())]",
+                      "type": "Microsoft.MachineLearningServices/workspaces/computes",
+                      "apiVersion": "2022-10-01",
+                      "name": "[format('{0}/{1}', parameters('machineLearningWorkspaceName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[if(empty(parameters('resourceId')), parameters('tags'), null())]",
+                      "sku": "[if(empty(parameters('resourceId')), createObject('name', parameters('sku'), 'tier', parameters('sku')), null())]",
+                      "identity": "[if(empty(parameters('resourceId')), variables('identity'), null())]",
+                      "properties": "[union(createObject('description', parameters('description'), 'disableLocalAuth', parameters('disableLocalAuth'), 'computeType', parameters('computeType')), if(not(empty(parameters('resourceId'))), createObject('resourceId', parameters('resourceId')), createObject('computeLocation', parameters('computeLocation'), 'properties', parameters('properties'))))]",
                       "dependsOn": [
-                        "privateEndpoint"
+                        "machineLearningWorkspace"
                       ]
                     }
                   },
                   "outputs": {
-                    "resourceGroupName": {
+                    "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group the private endpoint was deployed into."
+                        "description": "The name of the compute."
                       },
-                      "value": "[resourceGroup().name]"
+                      "value": "[parameters('name')]"
                     },
                     "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the private endpoint."
+                        "description": "The resource ID of the compute."
                       },
-                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                      "value": "[resourceId('Microsoft.MachineLearningServices/workspaces/computes', parameters('machineLearningWorkspaceName'), parameters('name'))]"
                     },
-                    "name": {
+                    "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the private endpoint."
+                        "description": "The resource group the compute was deployed into."
                       },
-                      "value": "[parameters('name')]"
+                      "value": "[resourceGroup().name]"
                     },
-                    "location": {
+                    "systemAssignedMIPrincipalId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The location the resource was deployed into."
+                        "description": "The principal ID of the system assigned identity."
                       },
-                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                      "value": "[coalesce(tryGet(tryGet(reference('compute', '2022-10-01', 'full'), 'identity'), 'principalId'), '')]"
                     },
-                    "groupId": {
+                    "location": {
                       "type": "string",
                       "metadata": {
-                        "description": "The group Id for the private endpoint Group."
+                        "description": "The location the resource was deployed into."
                       },
-                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                      "value": "[reference('compute', '2022-10-01', 'full').location]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "registry"
+                "workspace",
+                "workspace_privateEndpoints"
               ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The Name of the Azure container registry."
-              },
-              "value": "[parameters('name')]"
-            },
-            "loginServer": {
-              "type": "string",
-              "metadata": {
-                "description": "The reference to the Azure container registry."
-              },
-              "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2019-05-01').loginServer]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the Azure container registry."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the Azure container registry."
-              },
-              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[coalesce(tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId'), '')]"
             },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
+            "workspace_privateEndpoints": {
+              "copy": {
+                "name": "workspace_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
               },
-              "value": "[reference('registry', '2023-06-01-preview', 'full').location]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "managedIdentity"
-      ]
-    },
-    "applicationInsights": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2022-09-01",
-      "name": "[format('{0}-appi', uniqueString(deployment().name, parameters('location')))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[coalesce(tryGet(parameters('applicationInsightsSettings'), 'name'), format('appi-{0}', parameters('name')))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "kind": {
-            "value": "web"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "workspaceResourceId": {
-            "value": "[resourceId('Microsoft.OperationalInsights/workspaces', coalesce(tryGet(parameters('logAnalyticsSettings'), 'name'), format('log-{0}', parameters('name'))))]"
-          },
-          "roleAssignments": {
-            "value": [
-              {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Contributor"
-              }
-            ]
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "15992072010754675807"
-            },
-            "name": "Application Insights",
-            "description": "This component deploys an Application Insights instance.",
-            "owner": "Azure/module-maintainers"
-          },
-          "definitions": {
-            "roleAssignmentType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "roleDefinitionIdOrName": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                    }
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-workspace-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'amlworkspace'), copyIndex()))]"
                   },
-                  "principalId": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                    }
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'amlworkspace'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'amlworkspace')))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'amlworkspace'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'amlworkspace')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
                   },
-                  "principalType": {
-                    "type": "string",
-                    "allowedValues": [
-                      "Device",
-                      "ForeignGroup",
-                      "Group",
-                      "ServicePrincipal",
-                      "User"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The principal type of the assigned principal ID."
-                    }
+                  "enableTelemetry": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
                   },
-                  "description": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The description of the role assignment."
-                    }
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
                   },
-                  "condition": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                    }
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
                   },
-                  "conditionVersion": {
-                    "type": "string",
-                    "allowedValues": [
-                      "2.0"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Version of the condition."
-                    }
+                  "privateDnsZoneGroup": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
                   },
-                  "delegatedManagedIdentityResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The Resource Id of the delegated managed identity resource."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            },
-            "diagnosticSettingType": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of diagnostic setting."
-                    }
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "3308873178893851812"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint.",
+                    "owner": "Azure/module-maintainers"
                   },
-                  "logCategoriesAndGroups": {
-                    "type": "array",
-                    "items": {
+                  "definitions": {
+                    "privateDnsZoneGroupType": {
                       "type": "object",
                       "properties": {
-                        "category": {
+                        "name": {
                           "type": "string",
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                            "description": "Optional. The name of the Private DNS Zone Group."
                           }
                         },
-                        "categoryGroup": {
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
                           "type": "string",
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                            "description": "Optional. Specify the name of lock."
                           }
                         },
-                        "enabled": {
-                          "type": "bool",
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "ipConfigurationsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the resource that is unique within a resource group."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                }
+                              },
+                              "memberName": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                }
+                              },
+                              "privateIPAddress": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private endpoint IP configurations."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "manualPrivateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "privateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "customDnsConfigType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "fqdn": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                            }
+                          },
+                          "ipAddresses": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. A list of private IP addresses of the private endpoint."
+                            }
                           }
                         }
-                      }
+                      },
+                      "nullable": true
                     },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                    }
-                  },
-                  "metricCategories": {
-                    "type": "array",
-                    "items": {
+                    "privateDnsZoneGroupConfigType": {
                       "type": "object",
                       "properties": {
-                        "category": {
+                        "name": {
                           "type": "string",
+                          "nullable": true,
                           "metadata": {
-                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                            "description": "Optional. The name of the private DNS zone group config."
                           }
                         },
-                        "enabled": {
-                          "type": "bool",
-                          "nullable": true,
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
                           "metadata": {
-                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                            "description": "Required. The resource id of the private DNS zone."
                           }
                         }
-                      }
-                    },
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                    }
-                  },
-                  "logAnalyticsDestinationType": {
-                    "type": "string",
-                    "allowedValues": [
-                      "AzureDiagnostics",
-                      "Dedicated"
-                    ],
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                    }
-                  },
-                  "workspaceResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                    }
-                  },
-                  "storageAccountResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                    }
-                  },
-                  "eventHubAuthorizationRuleResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                    }
-                  },
-                  "eventHubName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                    }
-                  },
-                  "marketplacePartnerResourceId": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                    }
-                  }
-                }
-              },
-              "nullable": true
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the Application Insights."
-              }
-            },
-            "applicationType": {
-              "type": "string",
-              "defaultValue": "web",
-              "allowedValues": [
-                "web",
-                "other"
-              ],
-              "metadata": {
-                "description": "Optional. Application type."
-              }
-            },
-            "workspaceResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
-              }
-            },
-            "disableIpMasking": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Disable IP masking. Default value is set to true."
-              }
-            },
-            "disableLocalAuth": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
-              }
-            },
-            "forceCustomerStorageForProfiler": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Force users to create their own storage account for profiler and debugger."
-              }
-            },
-            "linkedStorageAccountResourceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. Linked storage account resource ID."
-              }
-            },
-            "publicNetworkAccessForIngestion": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
-              }
-            },
-            "publicNetworkAccessForQuery": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
-              }
-            },
-            "retentionInDays": {
-              "type": "int",
-              "defaultValue": 365,
-              "allowedValues": [
-                30,
-                60,
-                90,
-                120,
-                180,
-                270,
-                365,
-                550,
-                730
-              ],
-              "metadata": {
-                "description": "Optional. Retention period in days."
-              }
-            },
-            "samplingPercentage": {
-              "type": "int",
-              "defaultValue": 100,
-              "minValue": 0,
-              "maxValue": 100,
-              "metadata": {
-                "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "roleAssignments": {
-              "$ref": "#/definitions/roleAssignmentType",
-              "metadata": {
-                "description": "Optional. Array of role assignments to create."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "enableTelemetry": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Enable/Disable usage telemetry for module."
-              }
-            },
-            "diagnosticSettings": {
-              "$ref": "#/definitions/diagnosticSettingType",
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            }
-          },
-          "variables": {
-            "builtInRoleNames": {
-              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-            }
-          },
-          "resources": {
-            "avmTelemetry": {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
                     }
-                  }
-                }
-              }
-            },
-            "appInsights": {
-              "type": "Microsoft.Insights/components",
-              "apiVersion": "2020-02-02",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "kind": "[parameters('kind')]",
-              "properties": {
-                "Application_Type": "[parameters('applicationType')]",
-                "DisableIpMasking": "[parameters('disableIpMasking')]",
-                "DisableLocalAuth": "[parameters('disableLocalAuth')]",
-                "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
-                "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
-                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
-                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
-                "RetentionInDays": "[parameters('retentionInDays')]",
-                "SamplingPercentage": "[parameters('samplingPercentage')]"
-              }
-            },
-            "appInsights_roleAssignments": {
-              "copy": {
-                "name": "appInsights_roleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
-              "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-              },
-              "dependsOn": [
-                "appInsights"
-              ]
-            },
-            "appInsights_diagnosticSettings": {
-              "copy": {
-                "name": "appInsights_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "$ref": "#/definitions/ipConfigurationsType",
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
                     }
                   },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
                     }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "appInsights"
-              ]
-            },
-            "linkedStorageAccount": {
-              "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2022-09-01",
-              "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "appInsightsName": {
-                    "value": "[parameters('name')]"
                   },
-                  "storageAccountResourceId": {
-                    "value": "[parameters('linkedStorageAccountResourceId')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "11213930862679606021"
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
                     },
-                    "name": "Application Insights Linked Storage Account",
-                    "description": "This component deploys an Application Insights Linked Storage Account.",
-                    "owner": "Azure/module-maintainers"
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.29.47.4906",
+                              "templateHash": "5805178546717255803"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDnsZoneConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigsVar",
+                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                "input": {
+                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2023-11-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
                   },
-                  "parameters": {
-                    "appInsightsName": {
+                  "outputs": {
+                    "resourceGroupName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
-                      }
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
                     },
-                    "storageAccountResourceId": {
+                    "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. Linked storage account resource ID."
-                      }
-                    }
-                  },
-                  "resources": [
-                    {
-                      "type": "microsoft.insights/components/linkedStorageAccounts",
-                      "apiVersion": "2020-03-01-preview",
-                      "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
-                      "properties": {
-                        "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
-                      }
-                    }
-                  ],
-                  "outputs": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
                     "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The name of the Linked Storage Account."
+                        "description": "The name of the private endpoint."
                       },
-                      "value": "ServiceProfiler"
+                      "value": "[parameters('name')]"
                     },
-                    "resourceId": {
+                    "location": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the Linked Storage Account."
+                        "description": "The location the resource was deployed into."
                       },
-                      "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
                     },
-                    "resourceGroupName": {
+                    "customDnsConfig": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "The custom DNS configurations of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                    },
+                    "groupId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group the agent pool was deployed into."
+                        "description": "The group Id for the private endpoint Group."
                       },
-                      "value": "[resourceGroup().name]"
+                      "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
                     }
                   }
                 }
               },
               "dependsOn": [
-                "appInsights"
+                "workspace"
               ]
             }
           },
           "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the application insights component."
-              },
-              "value": "[parameters('name')]"
-            },
             "resourceId": {
               "type": "string",
               "metadata": {
-                "description": "The resource ID of the application insights component."
+                "description": "The resource ID of the machine learning service."
               },
-              "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+              "value": "[resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name'))]"
             },
             "resourceGroupName": {
               "type": "string",
               "metadata": {
-                "description": "The resource group the application insights component was deployed into."
+                "description": "The resource group the machine learning service was deployed into."
               },
               "value": "[resourceGroup().name]"
             },
-            "applicationId": {
-              "type": "string",
-              "metadata": {
-                "description": "The application ID of the application insights component."
-              },
-              "value": "[reference('appInsights').AppId]"
-            },
-            "location": {
+            "name": {
               "type": "string",
               "metadata": {
-                "description": "The location the resource was deployed into."
+                "description": "The name of the machine learning service."
               },
-              "value": "[reference('appInsights', '2020-02-02', 'full').location]"
+              "value": "[parameters('name')]"
             },
-            "instrumentationKey": {
+            "systemAssignedMIPrincipalId": {
               "type": "string",
               "metadata": {
-                "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+                "description": "The principal ID of the system assigned identity."
               },
-              "value": "[reference('appInsights').InstrumentationKey]"
+              "value": "[coalesce(tryGet(tryGet(reference('workspace', '2024-04-01-preview', 'full'), 'identity'), 'principalId'), '')]"
             },
-            "connectionString": {
+            "location": {
               "type": "string",
               "metadata": {
-                "description": "Application Insights Connection String."
+                "description": "The location the resource was deployed into."
               },
-              "value": "[reference('appInsights').ConnectionString]"
+              "value": "[reference('workspace', '2024-04-01-preview', 'full').location]"
             }
           }
         }
       },
       "dependsOn": [
-        "logAnalyticsWorkspace",
-        "managedIdentity"
+        "applicationInsights",
+        "containerRegistry",
+        "virtualNetwork::defaultSubnet",
+        "keyVault",
+        "managedIdentityHub",
+        "storageAccount",
+        "workspaceHub_privateDnsZones"
       ]
     },
-    "workspaceHub": {
+    "workspaceProject": {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-hub', uniqueString(deployment().name, parameters('location')))]",
+      "name": "[format('{0}-project', uniqueString(deployment().name, parameters('location')))]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
@@ -10798,64 +26736,44 @@
         "mode": "Incremental",
         "parameters": {
           "name": {
-            "value": "[coalesce(tryGet(parameters('workspaceHubSettings'), 'name'), format('hub-{0}', parameters('name')))]"
+            "value": "[coalesce(tryGet(parameters('workspaceConfiguration'), 'projectName'), format('project-{0}', parameters('name')))]"
           },
           "sku": {
             "value": "Standard"
           },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "enableTelemetry": {
-            "value": "[parameters('enableTelemetry')]"
-          },
-          "kind": {
-            "value": "Hub"
-          },
-          "associatedApplicationInsightsResourceId": {
-            "value": "[reference('applicationInsights').outputs.resourceId.value]"
-          },
-          "associatedKeyVaultResourceId": {
-            "value": "[reference('keyVault').outputs.resourceId.value]"
+          "location": {
+            "value": "[parameters('location')]"
           },
-          "associatedStorageAccountResourceId": {
-            "value": "[reference('storageAccount').outputs.resourceId.value]"
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
           },
-          "associatedContainerRegistryResourceId": {
-            "value": "[reference('containerRegistry').outputs.resourceId.value]"
+          "kind": {
+            "value": "Project"
           },
-          "workspaceHubConfig": {
-            "value": {
-              "defaultWorkspaceResourceGroup": "[resourceGroup().id]"
-            }
+          "hubResourceId": {
+            "value": "[reference('workspaceHub').outputs.resourceId.value]"
           },
           "managedIdentities": {
             "value": {
               "userAssignedResourceIds": [
-                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentitySettings'), 'name'), format('id-{0}', parameters('name'))))]"
+                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentityConfiguration'), 'projectName'), format('id-project-{0}', parameters('name'))))]"
               ]
             }
           },
           "primaryUserAssignedIdentity": {
-            "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentitySettings'), 'name'), format('id-{0}', parameters('name'))))]"
-          },
-          "computes": {
-            "value": "[tryGet(parameters('workspaceHubSettings'), 'computes')]"
-          },
-          "managedNetworkSettings": {
-            "value": {
-              "isolationMode": "[coalesce(tryGet(parameters('workspaceHubSettings'), 'networkIsolationMode'), 'AllowInternetOutbound')]",
-              "outboundRules": "[tryGet(parameters('workspaceHubSettings'), 'networkOutboundRules')]"
-            }
-          },
-          "systemDatastoresAuthMode": {
-            "value": "identity"
+            "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentityConfiguration'), 'projectName'), format('id-project-{0}', parameters('name'))))]"
           },
           "roleAssignments": {
             "value": [
               {
-                "principalId": "[reference('managedIdentity').principalId]",
-                "roleDefinitionIdOrName": "Contributor"
+                "principalId": "[reference('managedIdentityHub').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('managedIdentityProject').principalId]",
+                "roleDefinitionIdOrName": "Contributor",
+                "principalType": "ServicePrincipal"
               }
             ]
           },
@@ -10870,8 +26788,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "4962983970104260832"
+              "version": "0.29.47.4906",
+              "templateHash": "1726366914846644834"
             },
             "name": "Machine Learning Services Workspaces",
             "description": "This module deploys a Machine Learning Services Workspace.",
@@ -11030,21 +26948,44 @@
                       "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
                     }
                   },
-                  "privateDnsZoneGroupName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-                    }
-                  },
-                  "privateDnsZoneResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
+                  "privateDnsZoneGroup": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the Private DNS Zone Group."
+                        }
+                      },
+                      "privateDnsZoneGroupConfigs": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group config."
+                              }
+                            },
+                            "privateDnsZoneResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource id of the private DNS zone."
+                              }
+                            }
+                          }
+                        },
+                        "metadata": {
+                          "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                        }
+                      }
                     },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                      "description": "Optional. The private DNS zone group to configure for the private endpoint."
                     }
                   },
                   "isManualConnection": {
@@ -11876,7 +27817,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.machinelearningservices-workspace.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.machinelearningservices-workspace.{0}.{1}', replace('0.5.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -11993,7 +27934,7 @@
               "scope": "[format('Microsoft.MachineLearningServices/workspaces/{0}', parameters('name'))]",
               "name": "[guid(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
               "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                "roleDefinitionId": "[coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
                 "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
                 "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
                 "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
@@ -12066,8 +28007,8 @@
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.28.1.47646",
-                      "templateHash": "16086831886520789699"
+                      "version": "0.29.47.4906",
+                      "templateHash": "8580750401363518569"
                     },
                     "name": "Machine Learning Services Workspaces Computes",
                     "description": "This module deploys a Machine Learning Services Workspaces Compute.\n\nAttaching a compute is not idempotent and will fail in case you try to redeploy over an existing compute in AML (see parameter `deployCompute`).",
@@ -12309,11 +28250,8 @@
                   "lock": {
                     "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
                   },
-                  "privateDnsZoneGroupName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-                  },
-                  "privateDnsZoneResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  "privateDnsZoneGroup": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
                   },
                   "roleAssignments": {
                     "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -12341,19 +28279,47 @@
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "4120048060064073955"
+                      "version": "0.29.47.4906",
+                      "templateHash": "3308873178893851812"
                     },
                     "name": "Private Endpoints",
                     "description": "This module deploys a Private Endpoint.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
+                    "privateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      }
+                    },
                     "roleAssignmentType": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "properties": {
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                            }
+                          },
                           "roleDefinitionIdOrName": {
                             "type": "string",
                             "metadata": {
@@ -12457,13 +28423,13 @@
                               "groupId": {
                                 "type": "string",
                                 "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                                 }
                               },
                               "memberName": {
                                 "type": "string",
                                 "metadata": {
-                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                                 }
                               },
                               "privateIPAddress": {
@@ -12497,8 +28463,11 @@
                             "properties": {
                               "groupIds": {
                                 "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
                                 "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                                 }
                               },
                               "privateLinkServiceId": {
@@ -12538,8 +28507,11 @@
                             "properties": {
                               "groupIds": {
                                 "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
                                 "metadata": {
-                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                                 }
                               },
                               "privateLinkServiceId": {
@@ -12587,6 +28559,29 @@
                         }
                       },
                       "nullable": true
+                    },
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
                     }
                   },
                   "parameters": {
@@ -12622,18 +28617,11 @@
                         "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
                       }
                     },
-                    "privateDnsZoneGroupName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-                      }
-                    },
-                    "privateDnsZoneResourceIds": {
-                      "type": "array",
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
                       }
                     },
                     "location": {
@@ -12689,6 +28677,13 @@
                     }
                   },
                   "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
                     "builtInRoleNames": {
                       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
                       "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
@@ -12706,8 +28701,8 @@
                     "avmTelemetry": {
                       "condition": "[parameters('enableTelemetry')]",
                       "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2023-07-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
                       "properties": {
                         "mode": "Incremental",
                         "template": {
@@ -12725,7 +28720,7 @@
                     },
                     "privateEndpoint": {
                       "type": "Microsoft.Network/privateEndpoints",
-                      "apiVersion": "2023-04-01",
+                      "apiVersion": "2023-11-01",
                       "name": "[parameters('name')]",
                       "location": "[parameters('location')]",
                       "tags": "[parameters('tags')]",
@@ -12766,27 +28761,27 @@
                     "privateEndpoint_roleAssignments": {
                       "copy": {
                         "name": "privateEndpoint_roleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
                       },
                       "type": "Microsoft.Authorization/roleAssignments",
                       "apiVersion": "2022-04-01",
                       "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
                       "properties": {
-                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                       },
                       "dependsOn": [
                         "privateEndpoint"
                       ]
                     },
                     "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
                       "type": "Microsoft.Resources/deployments",
                       "apiVersion": "2022-09-01",
                       "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -12797,28 +28792,52 @@
                         "mode": "Incremental",
                         "parameters": {
                           "name": {
-                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                          },
-                          "privateDNSResourceIds": {
-                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                           },
                           "privateEndpointName": {
                             "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                           }
                         },
                         "template": {
                           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
                           "contentVersion": "1.0.0.0",
                           "metadata": {
                             "_generator": {
                               "name": "bicep",
-                              "version": "0.25.53.49325",
-                              "templateHash": "11244630631275470040"
+                              "version": "0.29.47.4906",
+                              "templateHash": "5805178546717255803"
                             },
                             "name": "Private Endpoint Private DNS Zone Groups",
                             "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                             "owner": "Azure/module-maintainers"
                           },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
                           "parameters": {
                             "privateEndpointName": {
                               "type": "string",
@@ -12826,12 +28845,15 @@
                                 "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                               }
                             },
-                            "privateDNSResourceIds": {
+                            "privateDnsZoneConfigs": {
                               "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
                               "minLength": 1,
                               "maxLength": 5,
                               "metadata": {
-                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                               }
                             },
                             "name": {
@@ -12845,27 +28867,36 @@
                           "variables": {
                             "copy": [
                               {
-                                "name": "privateDnsZoneConfigs",
-                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                "name": "privateDnsZoneConfigsVar",
+                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
                                 "input": {
-                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                                   "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                                   }
                                 }
                               }
                             ]
                           },
-                          "resources": [
-                            {
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
                               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                              "apiVersion": "2023-04-01",
+                              "apiVersion": "2023-11-01",
                               "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                               "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                              }
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
                             }
-                          ],
+                          },
                           "outputs": {
                             "name": {
                               "type": "string",
@@ -12923,14 +28954,21 @@
                       "metadata": {
                         "description": "The location the resource was deployed into."
                       },
-                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+                    },
+                    "customDnsConfig": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "The custom DNS configurations of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').customDnsConfigs]"
                     },
                     "groupId": {
                       "type": "string",
                       "metadata": {
                         "description": "The group Id for the private endpoint Group."
                       },
-                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                      "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
                     }
                   }
                 }
@@ -12980,11 +29018,9 @@
         }
       },
       "dependsOn": [
-        "applicationInsights",
-        "containerRegistry",
-        "keyVault",
-        "managedIdentity",
-        "storageAccount"
+        "managedIdentityHub",
+        "managedIdentityProject",
+        "workspaceHub"
       ]
     }
   },
@@ -13043,42 +29079,70 @@
       "metadata": {
         "description": "The resource ID of the log analytics workspace."
       },
-      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', coalesce(tryGet(parameters('logAnalyticsSettings'), 'name'), format('log-{0}', parameters('name'))))]"
+      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', coalesce(tryGet(parameters('logAnalyticsConfiguration'), 'name'), format('log-{0}', parameters('name'))))]"
     },
     "logAnalyticsWorkspaceName": {
       "type": "string",
       "metadata": {
         "description": "The name of the log analytics workspace."
       },
-      "value": "[coalesce(tryGet(parameters('logAnalyticsSettings'), 'name'), format('log-{0}', parameters('name')))]"
+      "value": "[coalesce(tryGet(parameters('logAnalyticsConfiguration'), 'name'), format('log-{0}', parameters('name')))]"
+    },
+    "managedIdentityHubResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the workspace hub user assigned managed identity."
+      },
+      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentityConfiguration'), 'hubName'), format('id-hub-{0}', parameters('name'))))]"
+    },
+    "managedIdentityHubName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the workspace hub user assigned managed identity."
+      },
+      "value": "[coalesce(tryGet(parameters('managedIdentityConfiguration'), 'hubName'), format('id-hub-{0}', parameters('name')))]"
     },
-    "managedIdentityResourceId": {
+    "managedIdentityHubPrincipalId": {
       "type": "string",
       "metadata": {
-        "description": "The resource ID of the user assigned managed identity."
+        "description": "The principal ID of the workspace hub user assigned managed identity."
       },
-      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentitySettings'), 'name'), format('id-{0}', parameters('name'))))]"
+      "value": "[reference('managedIdentityHub').principalId]"
     },
-    "managedIdentityName": {
+    "managedIdentityHubClientId": {
       "type": "string",
       "metadata": {
-        "description": "The name of the user assigned managed identity."
+        "description": "The client ID of the workspace hub user assigned managed identity."
       },
-      "value": "[coalesce(tryGet(parameters('managedIdentitySettings'), 'name'), format('id-{0}', parameters('name')))]"
+      "value": "[reference('managedIdentityHub').clientId]"
     },
-    "managedIdentityPrincipalId": {
+    "managedIdentityProjectResourceId": {
       "type": "string",
       "metadata": {
-        "description": "The principal ID of the user assigned managed identity."
+        "description": "The resource ID of the workspace project user assigned managed identity."
       },
-      "value": "[reference('managedIdentity').principalId]"
+      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', coalesce(tryGet(parameters('managedIdentityConfiguration'), 'projectName'), format('id-project-{0}', parameters('name'))))]"
     },
-    "managedIdentityClientId": {
+    "managedIdentityProjectName": {
       "type": "string",
       "metadata": {
-        "description": "The client ID of the user assigned managed identity."
+        "description": "The name of the workspace project user assigned managed identity."
       },
-      "value": "[reference('managedIdentity').clientId]"
+      "value": "[coalesce(tryGet(parameters('managedIdentityConfiguration'), 'projectName'), format('id-project-{0}', parameters('name')))]"
+    },
+    "managedIdentityProjectPrincipalId": {
+      "type": "string",
+      "metadata": {
+        "description": "The principal ID of the workspace project user assigned managed identity."
+      },
+      "value": "[reference('managedIdentityProject').principalId]"
+    },
+    "managedIdentityProjectClientId": {
+      "type": "string",
+      "metadata": {
+        "description": "The client ID of the workspace project user assigned managed identity."
+      },
+      "value": "[reference('managedIdentityProject').clientId]"
     },
     "keyVaultResourceId": {
       "type": "string",
@@ -13142,6 +29206,76 @@
         "description": "The name of the workspace hub."
       },
       "value": "[reference('workspaceHub').outputs.name.value]"
+    },
+    "workspaceProjectResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the workspace project."
+      },
+      "value": "[reference('workspaceProject').outputs.resourceId.value]"
+    },
+    "workspaceProjectName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the workspace project."
+      },
+      "value": "[reference('workspaceProject').outputs.name.value]"
+    },
+    "virtualNetworkResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the virtual network."
+      },
+      "value": "[if(variables('createVirtualNetwork'), resourceId('Microsoft.Network/virtualNetworks', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name')))), '')]"
+    },
+    "virtualNetworkName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the virtual network."
+      },
+      "value": "[if(variables('createVirtualNetwork'), coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))), '')]"
+    },
+    "virtualNetworkSubnetResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the subnet in the virtual network."
+      },
+      "value": "[if(variables('createVirtualNetwork'), resourceId('Microsoft.Network/virtualNetworks/subnets', coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'name'), format('vnet-{0}', parameters('name'))), coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'name'), 'default')), '')]"
+    },
+    "virtualNetworkSubnetName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the subnet in the virtual network."
+      },
+      "value": "[if(variables('createVirtualNetwork'), coalesce(tryGet(parameters('virtualNetworkConfiguration'), 'subnet', 'name'), 'default'), '')]"
+    },
+    "bastionResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Azure Bastion host."
+      },
+      "value": "[if(variables('createBastion'), reference('bastion').outputs.resourceId.value, '')]"
+    },
+    "bastionName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Azure Bastion host."
+      },
+      "value": "[if(variables('createBastion'), reference('bastion').outputs.name.value, '')]"
+    },
+    "virtualMachineResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the virtual machine."
+      },
+      "value": "[if(variables('createVirtualMachine'), reference('virtualMachine').outputs.resourceId.value, '')]"
+    },
+    "virtualMachineName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the virtual machine."
+      },
+      "value": "[if(variables('createVirtualMachine'), reference('virtualMachine').outputs.name.value, '')]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/defaults/main.test.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/defaults/main.test.bicep
index 4a4b754197..6bbf94c845 100644
--- a/avm/ptn/ai-platform/baseline/tests/e2e/defaults/main.test.bicep
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/defaults/main.test.bicep
@@ -23,6 +23,10 @@ param baseTime string = utcNow('u')
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Generated. The password to leverage for the login.')
+@secure()
+param password string = newGuid()
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -45,6 +49,10 @@ module testDeployment '../../../main.bicep' = [
     name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
     params: {
       name: '${namePrefix}${serviceShort}${substring(uniqueString(baseTime), 0, 3)}'
+      virtualMachineConfiguration: {
+        adminUsername: 'localAdminUser'
+        adminPassword: password
+      }
     }
   }
 ]
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/max/dependencies.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/max/dependencies.bicep
index 52276fa6f1..d2ea57bb6a 100644
--- a/avm/ptn/ai-platform/baseline/tests/e2e/max/dependencies.bicep
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/max/dependencies.bicep
@@ -4,6 +4,15 @@ param location string = resourceGroup().location
 @description('Required. The name of the Storage Account to create.')
 param storageAccountName string
 
+@description('Required. The name of the Maintenance Configuration to create.')
+param maintenanceConfigurationName string
+
+@description('Required. The name of the network security group to create.')
+param networkSecurityGroupName string
+
+@description('Required. The name of the Bastion Network Security Group to create.')
+param networkSecurityGroupBastionName string
+
 resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
   name: storageAccountName
   location: location
@@ -13,5 +22,185 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
   kind: 'StorageV2'
 }
 
+resource maintenanceConfiguration 'Microsoft.Maintenance/maintenanceConfigurations@2023-10-01-preview' = {
+  name: maintenanceConfigurationName
+  location: location
+  properties: {
+    extensionProperties: {
+      InGuestPatchMode: 'User'
+    }
+    maintenanceScope: 'InGuestPatch'
+    maintenanceWindow: {
+      startDateTime: '2024-06-16 00:00'
+      duration: '03:55'
+      timeZone: 'W. Europe Standard Time'
+      recurEvery: '1Day'
+    }
+    visibility: 'Custom'
+    installPatches: {
+      rebootSetting: 'IfRequired'
+      windowsParameters: {
+        classificationsToInclude: [
+          'Critical'
+          'Security'
+        ]
+      }
+    }
+  }
+}
+
+resource networkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2023-11-01' = {
+  name: networkSecurityGroupName
+  location: location
+  properties: {
+    securityRules: [
+      {
+        name: 'DenyAnySSHInbound'
+        properties: {
+          access: 'Deny'
+          direction: 'Inbound'
+          protocol: 'Tcp'
+          priority: 100
+          sourcePortRange: '*'
+          sourceAddressPrefix: '*'
+          destinationPortRange: '22'
+          destinationAddressPrefix: '*'
+        }
+      }
+    ]
+  }
+}
+
+resource networkSecurityGroupBastion 'Microsoft.Network/networkSecurityGroups@2023-04-01' = {
+  name: networkSecurityGroupBastionName
+  location: location
+  properties: {
+    securityRules: [
+      {
+        name: 'AllowHttpsInbound'
+        properties: {
+          priority: 120
+          protocol: 'Tcp'
+          access: 'Allow'
+          direction: 'Inbound'
+          sourceAddressPrefix: 'Internet'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '443'
+        }
+      }
+      {
+        name: 'AllowGatewayManagerInbound'
+        properties: {
+          priority: 130
+          protocol: 'Tcp'
+          access: 'Allow'
+          direction: 'Inbound'
+          sourceAddressPrefix: 'GatewayManager'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '443'
+        }
+      }
+      {
+        name: 'AllowAzureLoadBalancerInbound'
+        properties: {
+          priority: 140
+          protocol: 'Tcp'
+          access: 'Allow'
+          direction: 'Inbound'
+          sourceAddressPrefix: 'AzureLoadBalancer'
+          sourcePortRange: '*'
+          destinationAddressPrefix: '*'
+          destinationPortRange: '443'
+        }
+      }
+      {
+        name: 'AllowBastionHostCommunication'
+        properties: {
+          priority: 150
+          protocol: '*'
+          access: 'Allow'
+          direction: 'Inbound'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'VirtualNetwork'
+          destinationPortRanges: [
+            '8080'
+            '5701'
+          ]
+        }
+      }
+      {
+        name: 'AllowSshOutbound'
+        properties: {
+          priority: 100
+          protocol: '*'
+          access: 'Allow'
+          direction: 'Outbound'
+          sourceAddressPrefix: '*'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'VirtualNetwork'
+          destinationPortRanges: [
+            '22'
+            '3389'
+          ]
+        }
+      }
+      {
+        name: 'AllowAzureCloudOutbound'
+        properties: {
+          priority: 110
+          protocol: 'Tcp'
+          access: 'Allow'
+          direction: 'Outbound'
+          sourceAddressPrefix: '*'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'AzureCloud'
+          destinationPortRange: '443'
+        }
+      }
+      {
+        name: 'AllowBastionCommunication'
+        properties: {
+          priority: 120
+          protocol: '*'
+          access: 'Allow'
+          direction: 'Outbound'
+          sourceAddressPrefix: 'VirtualNetwork'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'VirtualNetwork'
+          destinationPortRanges: [
+            '8080'
+            '5701'
+          ]
+        }
+      }
+      {
+        name: 'AllowHttpOutbound'
+        properties: {
+          priority: 130
+          protocol: '*'
+          access: 'Allow'
+          direction: 'Outbound'
+          sourceAddressPrefix: '*'
+          sourcePortRange: '*'
+          destinationAddressPrefix: 'Internet'
+          destinationPortRange: '80'
+        }
+      }
+    ]
+  }
+}
+
 @description('The resource ID of the created Storage Account.')
 output storageAccountResourceId string = storageAccount.id
+
+@description('The resource ID of the created Network Security Group.')
+output networkSecurityGroupResourceId string = networkSecurityGroup.id
+
+@description('The resource ID of the created Bastion Network Security Group.')
+output networkSecurityGroupBastionResourceId string = networkSecurityGroupBastion.id
+
+@description('The resource ID of the maintenance configuration.')
+output maintenanceConfigurationResourceId string = maintenanceConfiguration.id
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/max/main.test.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/max/main.test.bicep
index 40e8bd5835..240496050a 100644
--- a/avm/ptn/ai-platform/baseline/tests/e2e/max/main.test.bicep
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/max/main.test.bicep
@@ -23,6 +23,10 @@ param baseTime string = utcNow('u')
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Generated. The password to leverage for the login.')
+@secure()
+param password string = newGuid()
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -34,6 +38,18 @@ resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
   location: resourceLocation
 }
 
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    location: resourceLocation
+    storageAccountName: 'dep${namePrefix}st${serviceShort}'
+    maintenanceConfigurationName: 'dep-${namePrefix}-mc-${serviceShort}'
+    networkSecurityGroupName: 'dep${namePrefix}nsg${serviceShort}'
+    networkSecurityGroupBastionName: 'dep-${namePrefix}-nsg-bastion-${serviceShort}'
+  }
+}
+
 // ============== //
 // Test Execution //
 // ============== //
@@ -45,34 +61,94 @@ module testDeployment '../../../main.bicep' = [
     name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
     params: {
       name: '${namePrefix}${serviceShort}'
-      managedIdentitySettings: {
-        name: '${namePrefix}-id-${serviceShort}'
+      managedIdentityConfiguration: {
+        hubName: '${namePrefix}-id-hub-${serviceShort}'
+        projectName: '${namePrefix}-id-project-${serviceShort}'
       }
-      logAnalyticsSettings: {
+      logAnalyticsConfiguration: {
         name: '${namePrefix}-log-${serviceShort}'
       }
-      keyVaultSettings: {
+      keyVaultConfiguration: {
         name: '${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}'
         enablePurgeProtection: false
       }
-      storageAccountSettings: {
+      storageAccountConfiguration: {
         name: '${namePrefix}st${serviceShort}'
         sku: 'Standard_GRS'
         allowSharedKeyAccess: true
       }
-      containerRegistrySettings: {
+      containerRegistryConfiguration: {
         name: '${namePrefix}cr${serviceShort}'
         trustPolicyStatus: 'disabled'
       }
-      applicationInsightsSettings: {
+      applicationInsightsConfiguration: {
         name: '${namePrefix}-appi-${serviceShort}'
       }
-      workspaceHubSettings: {
+      virtualNetworkConfiguration: {
+        name: '${namePrefix}-vnet-${serviceShort}'
+        addressPrefix: '10.1.0.0/16'
+        enabled: true
+        subnet: {
+          name: '${namePrefix}-snet-${serviceShort}'
+          addressPrefix: '10.1.0.0/24'
+          networkSecurityGroupResourceId: nestedDependencies.outputs.networkSecurityGroupResourceId
+        }
+      }
+      bastionConfiguration: {
+        enabled: true
+        name: '${namePrefix}-bas-${serviceShort}'
+        sku: 'Standard'
+        networkSecurityGroupResourceId: nestedDependencies.outputs.networkSecurityGroupBastionResourceId
+        subnetAddressPrefix: '10.1.1.0/26'
+        disableCopyPaste: true
+        enableFileCopy: true
+        enableIpConnect: true
+        enableKerberos: true
+        enableShareableLink: true
+        scaleUnits: 3
+      }
+      virtualMachineConfiguration: {
+        enabled: true
+        name: take('${namePrefix}-vm-${serviceShort}', 15)
+        zone: 0
+        size: 'Standard_DS1_v2'
+        adminUsername: 'localAdminUser'
+        adminPassword: password
+        nicConfigurationConfiguration: {
+          name: '${namePrefix}-nic-${serviceShort}'
+          ipConfigName: '${namePrefix}-ipcfg-${serviceShort}'
+          privateIPAllocationMethod: 'Dynamic'
+          networkSecurityGroupResourceId: nestedDependencies.outputs.networkSecurityGroupResourceId
+        }
+        imageReference: {
+          publisher: 'microsoft-dsvm'
+          offer: 'dsvm-win-2022'
+          sku: 'winserver-2022'
+          version: 'latest'
+        }
+        osDisk: {
+          name: '${namePrefix}-disk-${serviceShort}'
+          diskSizeGB: 256
+          createOption: 'FromImage'
+          caching: 'ReadOnly'
+          managedDisk: {
+            storageAccountType: 'Standard_LRS'
+          }
+          deleteOption: 'Delete'
+        }
+        patchMode: 'AutomaticByPlatform'
+        encryptionAtHost: false
+        enableAadLoginExtension: true
+        enableAzureMonitorAgent: true
+        maintenanceConfigurationResourceId: nestedDependencies.outputs.maintenanceConfigurationResourceId
+      }
+      workspaceConfiguration: {
         name: '${namePrefix}-hub-${serviceShort}'
+        projectName: '${namePrefix}-project-${serviceShort}'
         computes: [
           {
             computeType: 'ComputeInstance'
-            name: 'compute-${substring(uniqueString(baseTime), 0, 3)}'
+            name: 'c-${substring(uniqueString(baseTime), 0, 3)}-${serviceShort}'
             description: 'Default'
             location: resourceLocation
             properties: {
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/no-vm/main.test.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/no-vm/main.test.bicep
new file mode 100644
index 0000000000..f625b82319
--- /dev/null
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/no-vm/main.test.bicep
@@ -0,0 +1,56 @@
+targetScope = 'subscription'
+
+metadata name = 'Without virtual machine'
+metadata description = 'This instance deploys the module with a virtual network, but no virtual machine or Azure Bastion host.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-aiplatform-baseline-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'aipbnovm'
+
+@description('Generated. Used as a basis for unique resource names.')
+param baseTime string = utcNow('u')
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}${substring(uniqueString(baseTime), 0, 3)}'
+      bastionConfiguration: {
+        enabled: false
+      }
+      virtualMachineConfiguration: {
+        enabled: false
+      }
+    }
+  }
+]
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/no-vnet/main.test.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/no-vnet/main.test.bicep
new file mode 100644
index 0000000000..2a6d709944
--- /dev/null
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/no-vnet/main.test.bicep
@@ -0,0 +1,53 @@
+targetScope = 'subscription'
+
+metadata name = 'Without virtual network'
+metadata description = 'This instance deploys the module without a virtual network, virtual machine or Azure Bastion host.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-aiplatform-baseline-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'aipbnovnet'
+
+@description('Generated. Used as a basis for unique resource names.')
+param baseTime string = utcNow('u')
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}${substring(uniqueString(baseTime), 0, 3)}'
+      virtualNetworkConfiguration: {
+        enabled: false
+      }
+    }
+  }
+]
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/dependencies.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/dependencies.bicep
index 52276fa6f1..299d71ad37 100644
--- a/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/dependencies.bicep
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/dependencies.bicep
@@ -1,6 +1,9 @@
 @description('Optional. The location to deploy to.')
 param location string = resourceGroup().location
 
+@description('Required. The name of the Maintenance Configuration to create.')
+param maintenanceConfigurationName string
+
 @description('Required. The name of the Storage Account to create.')
 param storageAccountName string
 
@@ -13,5 +16,35 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
   kind: 'StorageV2'
 }
 
+resource maintenanceConfiguration 'Microsoft.Maintenance/maintenanceConfigurations@2023-10-01-preview' = {
+  name: maintenanceConfigurationName
+  location: location
+  properties: {
+    extensionProperties: {
+      InGuestPatchMode: 'User'
+    }
+    maintenanceScope: 'InGuestPatch'
+    maintenanceWindow: {
+      startDateTime: '2024-06-16 00:00'
+      duration: '03:55'
+      timeZone: 'W. Europe Standard Time'
+      recurEvery: '1Day'
+    }
+    visibility: 'Custom'
+    installPatches: {
+      rebootSetting: 'IfRequired'
+      windowsParameters: {
+        classificationsToInclude: [
+          'Critical'
+          'Security'
+        ]
+      }
+    }
+  }
+}
+
 @description('The resource ID of the created Storage Account.')
 output storageAccountResourceId string = storageAccount.id
+
+@description('The resource ID of the maintenance configuration.')
+output maintenanceConfigurationResourceId string = maintenanceConfiguration.id
diff --git a/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/main.test.bicep b/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/main.test.bicep
index e73889fa29..21d1ba8934 100644
--- a/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/ptn/ai-platform/baseline/tests/e2e/waf-aligned/main.test.bicep
@@ -11,8 +11,9 @@ metadata description = 'This instance deploys the module in alignment with the b
 @maxLength(90)
 param resourceGroupName string = 'dep-${namePrefix}-aiplatform-baseline-${serviceShort}-rg'
 
-@description('Optional. The location to deploy resources to.')
-param resourceLocation string = deployment().location
+// Enforce uksouth to avoid restrictions around VM zones in certain regions
+#disable-next-line no-hardcoded-location
+var enforcedLocation = 'uksouth'
 
 @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
 param serviceShort string = 'aipbwaf'
@@ -23,6 +24,10 @@ param baseTime string = utcNow('u')
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Generated. The password to leverage for the login.')
+@secure()
+param password string = newGuid()
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -31,15 +36,16 @@ param namePrefix string = '#_namePrefix_#'
 // =================
 resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
   name: resourceGroupName
-  location: resourceLocation
+  location: enforcedLocation
 }
 
 module nestedDependencies 'dependencies.bicep' = {
   scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  name: '${uniqueString(deployment().name, enforcedLocation)}-nestedDependencies'
   params: {
     storageAccountName: 'dep${namePrefix}st${serviceShort}'
-    location: resourceLocation
+    maintenanceConfigurationName: 'dep-${namePrefix}-mc-${serviceShort}'
+    location: enforcedLocation
   }
 }
 
@@ -51,10 +57,19 @@ module nestedDependencies 'dependencies.bicep' = {
 module testDeployment '../../../main.bicep' = [
   for iteration in ['init', 'idem']: {
     scope: resourceGroup
-    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    name: '${uniqueString(deployment().name, enforcedLocation)}-test-${serviceShort}-${iteration}'
     params: {
       name: '${namePrefix}${serviceShort}${substring(uniqueString(baseTime), 0, 3)}'
-      workspaceHubSettings: {
+      virtualMachineConfiguration: {
+        adminUsername: 'localAdminUser'
+        adminPassword: password
+        enableAadLoginExtension: true
+        enableAzureMonitorAgent: true
+        maintenanceConfigurationResourceId: nestedDependencies.outputs.maintenanceConfigurationResourceId
+        patchMode: 'AutomaticByPlatform'
+        zone: 1
+      }
+      workspaceConfiguration: {
         networkIsolationMode: 'AllowOnlyApprovedOutbound'
         networkOutboundRules: {
           rule: {
diff --git a/avm/ptn/ai-platform/baseline/version.json b/avm/ptn/ai-platform/baseline/version.json
index 0200aa0775..aa34c4d0f5 100644
--- a/avm/ptn/ai-platform/baseline/version.json
+++ b/avm/ptn/ai-platform/baseline/version.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.1",
+  "version": "0.4",
   "pathFilters": [
-      "./main.json"
+    "./main.json"
   ]
 }
diff --git a/avm/ptn/authorization/policy-assignment/README.md b/avm/ptn/authorization/policy-assignment/README.md
index c135d3933c..a4cb51a7ea 100644
--- a/avm/ptn/authorization/policy-assignment/README.md
+++ b/avm/ptn/authorization/policy-assignment/README.md
@@ -126,7 +126,7 @@ module policyAssignment 'br/public:avm/ptn/authorization/policy-assignment:<vers
       }
     ]
     notScopes: [
-      '/subscriptions/${subscriptionId}/resourceGroups/validation-rg'
+      '/subscriptions/<value>/resourceGroups/validation-rg'
     ]
     overrides: [
       {
@@ -231,7 +231,7 @@ module policyAssignment 'br/public:avm/ptn/authorization/policy-assignment:<vers
     },
     "notScopes": {
       "value": [
-        "/subscriptions/${subscriptionId}/resourceGroups/validation-rg"
+        "/subscriptions/<value>/resourceGroups/validation-rg"
       ]
     },
     "overrides": {
@@ -673,7 +673,7 @@ module policyAssignment 'br/public:avm/ptn/authorization/policy-assignment:<vers
       }
     ]
     notScopes: [
-      '/subscriptions/${subscriptionId}/resourceGroups/validation-rg'
+      '/subscriptions/<value>/resourceGroups/validation-rg'
     ]
     overrides: [
       {
@@ -777,7 +777,7 @@ module policyAssignment 'br/public:avm/ptn/authorization/policy-assignment:<vers
     },
     "notScopes": {
       "value": [
-        "/subscriptions/${subscriptionId}/resourceGroups/validation-rg"
+        "/subscriptions/<value>/resourceGroups/validation-rg"
       ]
     },
     "overrides": {
@@ -873,7 +873,7 @@ module policyAssignment 'br/public:avm/ptn/authorization/policy-assignment:<vers
 | [`parameters`](#parameter-parameters) | object | Parameters for the policy assignment if needed. |
 | [`resourceGroupName`](#parameter-resourcegroupname) | string | The Target Scope for the Policy. The name of the resource group for the policy assignment. |
 | [`resourceSelectors`](#parameter-resourceselectors) | array | The resource selector list to filter policies by resource properties. Facilitates safe deployment practices (SDP) by enabling gradual roll out policy assignments based on factors like resource location, resource type, or whether a resource has a location. |
-| [`roleDefinitionIds`](#parameter-roledefinitionids) | array | The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition. |
+| [`roleDefinitionIds`](#parameter-roledefinitionids) | array | The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition. |
 | [`subscriptionId`](#parameter-subscriptionid) | string | The Target Scope for the Policy. The subscription ID of the subscription for the policy assignment. |
 | [`userAssignedIdentityId`](#parameter-userassignedidentityid) | string | The Resource ID for the user assigned identity to assign to the policy assignment. |
 
@@ -1020,7 +1020,7 @@ The resource selector list to filter policies by resource properties. Facilitate
 
 ### Parameter: `roleDefinitionIds`
 
-The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition.
+The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition.
 
 - Required: No
 - Type: array
diff --git a/avm/ptn/authorization/policy-assignment/main.bicep b/avm/ptn/authorization/policy-assignment/main.bicep
index e68154ebed..bb2508a723 100644
--- a/avm/ptn/authorization/policy-assignment/main.bicep
+++ b/avm/ptn/authorization/policy-assignment/main.bicep
@@ -31,7 +31,7 @@ param identity string = 'SystemAssigned'
 @sys.description('Optional. The Resource ID for the user assigned identity to assign to the policy assignment.')
 param userAssignedIdentityId string = ''
 
-@sys.description('Optional. The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition.')
+@sys.description('Optional. The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition.')
 param roleDefinitionIds array = []
 
 @sys.description('Optional. The policy assignment metadata. Metadata is an open ended object and is typically a collection of key-value pairs.')
diff --git a/avm/ptn/authorization/policy-assignment/main.json b/avm/ptn/authorization/policy-assignment/main.json
index 919bbe2648..a7296fd6f9 100644
--- a/avm/ptn/authorization/policy-assignment/main.json
+++ b/avm/ptn/authorization/policy-assignment/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "7409207305186624461"
+      "version": "0.29.47.4906",
+      "templateHash": "2876622926889063776"
     },
     "name": "Policy Assignments (All scopes)",
     "description": "This module deploys a Policy Assignment at a Management Group, Subscription or Resource Group scope.",
@@ -69,7 +69,7 @@
       "type": "array",
       "defaultValue": [],
       "metadata": {
-        "description": "Optional. The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition."
+        "description": "Optional. The IDs Of the Azure Role Definition list that is used to assign permissions to the identity. You need to provide either the fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles for the list IDs for built-in Roles. They must match on what is on the policy definition."
       }
     },
     "metadata": {
@@ -226,8 +226,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "10754608594936413857"
+              "version": "0.29.47.4906",
+              "templateHash": "3257252324855693362"
             },
             "name": "Policy Assignments (Management Group scope)",
             "description": "This module deploys a Policy Assignment at a Management Group scope.",
@@ -481,8 +481,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "14066444680843928013"
+              "version": "0.29.47.4906",
+              "templateHash": "3684200367628760752"
             },
             "name": "Policy Assignments (Subscription scope)",
             "description": "This module deploys a Policy Assignment at a Subscription scope.",
@@ -736,8 +736,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "17693268287104969526"
+              "version": "0.29.47.4906",
+              "templateHash": "3879842459774615474"
             },
             "name": "Policy Assignments (Resource Group scope)",
             "description": "This module deploys a Policy Assignment at a Resource Group scope.",
diff --git a/avm/ptn/azd/container-apps/README.md b/avm/ptn/azd/container-apps/README.md
new file mode 100644
index 0000000000..144948db21
--- /dev/null
+++ b/avm/ptn/azd/container-apps/README.md
@@ -0,0 +1,364 @@
+# avm/ptn/azd/container-apps `[Azd/ContainerApps]`
+
+Creates an Azure Container Registry and an Azure Container Apps environment.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Usage examples](#Usage-examples)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+- [Cross-referenced modules](#Cross-referenced-modules)
+- [Data Collection](#Data-Collection)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.App/managedEnvironments` | [2024-02-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2024-02-02-preview/managedEnvironments) |
+| `Microsoft.App/managedEnvironments/storages` | [2024-02-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2024-02-02-preview/managedEnvironments/storages) |
+| `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
+| `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
+| `Microsoft.ContainerRegistry/registries` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries) |
+| `Microsoft.ContainerRegistry/registries/cacheRules` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/cacheRules) |
+| `Microsoft.ContainerRegistry/registries/credentialSets` | [2023-11-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/credentialSets) |
+| `Microsoft.ContainerRegistry/registries/replications` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/replications) |
+| `Microsoft.ContainerRegistry/registries/scopeMaps` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/scopeMaps) |
+| `Microsoft.ContainerRegistry/registries/webhooks` | [2023-06-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ContainerRegistry/registries/webhooks) |
+| `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
+| `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+
+## Usage examples
+
+The following section provides usage examples for the module, which were used to validate and deploy the module successfully. For a full reference, please review the module's test folder in its repository.
+
+>**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order.
+
+>**Note**: To reference the module, please use the following syntax `br/public:avm/ptn/azd/container-apps:<version>`.
+
+- [With zoneRedundant enabled](#example-1-with-zoneredundant-enabled)
+
+### Example 1: _With zoneRedundant enabled_
+
+This instance deploys the module with zoneRedundant enabled.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module containerApps 'br/public:avm/ptn/azd/container-apps:<version>' = {
+  name: 'containerAppsDeployment'
+  params: {
+    // Required parameters
+    containerAppsEnvironmentName: 'acazrcae001'
+    containerRegistryName: 'acazrcr001'
+    logAnalyticsWorkspaceResourceId: '<logAnalyticsWorkspaceResourceId>'
+    // Non-required parameters
+    acrSku: 'Standard'
+    dockerBridgeCidr: '172.16.0.1/28'
+    infrastructureResourceGroupName: '<infrastructureResourceGroupName>'
+    infrastructureSubnetResourceId: '<infrastructureSubnetResourceId>'
+    internal: true
+    location: '<location>'
+    platformReservedCidr: '172.17.17.0/24'
+    platformReservedDnsIP: '172.17.17.17'
+    workloadProfiles: [
+      {
+        maximumCount: 3
+        minimumCount: 0
+        name: 'CAW01'
+        workloadProfileType: 'D4'
+      }
+    ]
+    zoneRedundant: true
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "containerAppsEnvironmentName": {
+      "value": "acazrcae001"
+    },
+    "containerRegistryName": {
+      "value": "acazrcr001"
+    },
+    "logAnalyticsWorkspaceResourceId": {
+      "value": "<logAnalyticsWorkspaceResourceId>"
+    },
+    // Non-required parameters
+    "acrSku": {
+      "value": "Standard"
+    },
+    "dockerBridgeCidr": {
+      "value": "172.16.0.1/28"
+    },
+    "infrastructureResourceGroupName": {
+      "value": "<infrastructureResourceGroupName>"
+    },
+    "infrastructureSubnetResourceId": {
+      "value": "<infrastructureSubnetResourceId>"
+    },
+    "internal": {
+      "value": true
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "platformReservedCidr": {
+      "value": "172.17.17.0/24"
+    },
+    "platformReservedDnsIP": {
+      "value": "172.17.17.17"
+    },
+    "workloadProfiles": {
+      "value": [
+        {
+          "maximumCount": 3,
+          "minimumCount": 0,
+          "name": "CAW01",
+          "workloadProfileType": "D4"
+        }
+      ]
+    },
+    "zoneRedundant": {
+      "value": true
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`containerAppsEnvironmentName`](#parameter-containerappsenvironmentname) | string | Name of the Container Apps Managed Environment. |
+| [`containerRegistryName`](#parameter-containerregistryname) | string | Name of the Azure Container Registry. |
+| [`logAnalyticsWorkspaceResourceId`](#parameter-loganalyticsworkspaceresourceid) | string | Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990). |
+
+**Conditional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`dockerBridgeCidr`](#parameter-dockerbridgecidr) | string | CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant. |
+| [`infrastructureSubnetResourceId`](#parameter-infrastructuresubnetresourceid) | string | Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if "internal" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant. |
+| [`internal`](#parameter-internal) | bool | Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then "infrastructureSubnetId" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant. |
+| [`platformReservedCidr`](#parameter-platformreservedcidr) | string | IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant. |
+| [`platformReservedDnsIP`](#parameter-platformreserveddnsip) | string | An IP address from the IP range defined by "platformReservedCidr" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant. |
+| [`workloadProfiles`](#parameter-workloadprofiles) | array | Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`acrAdminUserEnabled`](#parameter-acradminuserenabled) | bool | Enable admin user that have push / pull permission to the registry. |
+| [`acrSku`](#parameter-acrsku) | string | SKU settings. Default is "Standard". |
+| [`appInsightsConnectionString`](#parameter-appinsightsconnectionstring) | securestring | Application Insights connection string. |
+| [`containerRegistryResourceGroupName`](#parameter-containerregistryresourcegroupname) | string | Name of the Azure Container Registry Resource Group. |
+| [`daprAIInstrumentationKey`](#parameter-dapraiinstrumentationkey) | securestring | Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry. |
+| [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
+| [`infrastructureResourceGroupName`](#parameter-infrastructureresourcegroupname) | string | Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant. |
+| [`location`](#parameter-location) | string | Location for all Resources. |
+| [`tags`](#parameter-tags) | object | Tags of the resource. |
+| [`zoneRedundant`](#parameter-zoneredundant) | bool | Zone redundancy setting. |
+
+### Parameter: `containerAppsEnvironmentName`
+
+Name of the Container Apps Managed Environment.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `containerRegistryName`
+
+Name of the Azure Container Registry.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `logAnalyticsWorkspaceResourceId`
+
+Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990).
+
+- Required: Yes
+- Type: string
+
+### Parameter: `dockerBridgeCidr`
+
+CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `infrastructureSubnetResourceId`
+
+Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if "internal" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `internal`
+
+Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then "infrastructureSubnetId" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
+### Parameter: `platformReservedCidr`
+
+IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `platformReservedDnsIP`
+
+An IP address from the IP range defined by "platformReservedCidr" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `workloadProfiles`
+
+Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `acrAdminUserEnabled`
+
+Enable admin user that have push / pull permission to the registry.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
+### Parameter: `acrSku`
+
+SKU settings. Default is "Standard".
+
+- Required: No
+- Type: string
+- Default: `'Standard'`
+- Allowed:
+  ```Bicep
+  [
+    'Basic'
+    'Premium'
+    'Standard'
+  ]
+  ```
+
+### Parameter: `appInsightsConnectionString`
+
+Application Insights connection string.
+
+- Required: No
+- Type: securestring
+- Default: `''`
+
+### Parameter: `containerRegistryResourceGroupName`
+
+Name of the Azure Container Registry Resource Group.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+### Parameter: `daprAIInstrumentationKey`
+
+Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry.
+
+- Required: No
+- Type: securestring
+- Default: `''`
+
+### Parameter: `enableTelemetry`
+
+Enable/Disable usage telemetry for module.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+### Parameter: `infrastructureResourceGroupName`
+
+Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant.
+
+- Required: No
+- Type: string
+- Default: `[take(format('ME_{0}', parameters('containerAppsEnvironmentName')), 63)]`
+
+### Parameter: `location`
+
+Location for all Resources.
+
+- Required: No
+- Type: string
+- Default: `[resourceGroup().location]`
+
+### Parameter: `tags`
+
+Tags of the resource.
+
+- Required: No
+- Type: object
+
+### Parameter: `zoneRedundant`
+
+Zone redundancy setting.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `defaultDomain` | string | The Default domain of the Managed Environment. |
+| `environmentName` | string | The name of the Managed Environment. |
+| `environmentResourceId` | string | The resource ID of the Managed Environment. |
+| `registryLoginServer` | string | The reference to the Azure container registry. |
+| `registryName` | string | The Name of the Azure container registry. |
+| `resourceGroupName` | string | The name of the resource group the all resources was deployed into. |
+
+## Cross-referenced modules
+
+This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
+
+| Reference | Type |
+| :-- | :-- |
+| `br/public:avm/res/app/managed-environment:0.7.0` | Remote reference |
+| `br/public:avm/res/container-registry/registry:0.4.0` | Remote reference |
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the [repository](https://aka.ms/avm/telemetry). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
diff --git a/avm/ptn/azd/container-apps/main.bicep b/avm/ptn/azd/container-apps/main.bicep
new file mode 100644
index 0000000000..9a99522cd4
--- /dev/null
+++ b/avm/ptn/azd/container-apps/main.bicep
@@ -0,0 +1,138 @@
+metadata name = 'avm/ptn/azd/container-apps'
+metadata description = 'Creates an Azure Container Registry and an Azure Container Apps environment.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Optional. Location for all Resources.')
+param location string = resourceGroup().location
+
+@description('Optional. Tags of the resource.')
+param tags object?
+
+@description('Required. Name of the Container Apps Managed Environment.')
+param containerAppsEnvironmentName string
+
+@description('Required. Name of the Azure Container Registry.')
+param containerRegistryName string
+
+@description('Optional. Name of the Azure Container Registry Resource Group.')
+param containerRegistryResourceGroupName string = ''
+
+@description('Optional. Enable admin user that have push / pull permission to the registry.')
+param acrAdminUserEnabled bool = false
+
+@description('Required. Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990).')
+param logAnalyticsWorkspaceResourceId string
+
+@description('Optional. Application Insights connection string.')
+@secure()
+param appInsightsConnectionString string = ''
+
+@description('Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry.')
+@secure()
+param daprAIInstrumentationKey string = ''
+
+@description('Optional. SKU settings. Default is "Standard".')
+@allowed([
+  'Basic'
+  'Premium'
+  'Standard'
+])
+param acrSku string = 'Standard'
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Optional. Zone redundancy setting.')
+param zoneRedundant bool = true
+
+@description('Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant.')
+param dockerBridgeCidr string = ''
+
+@description('Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if "internal" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant.')
+param infrastructureSubnetResourceId string = ''
+
+@description('Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then "infrastructureSubnetId" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant.')
+param internal bool = false
+
+@description('Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant.')
+param platformReservedCidr string = ''
+
+@description('Conditional. An IP address from the IP range defined by "platformReservedCidr" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant.')
+param platformReservedDnsIP string = ''
+
+@description('Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant.')
+param workloadProfiles array = []
+
+@description('Optional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant.')
+param infrastructureResourceGroupName string = take('ME_${containerAppsEnvironmentName}', 63)
+
+#disable-next-line no-deployments-resources
+resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) {
+  name: '46d3xbcp.ptn.azd-containerapps.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
+  properties: {
+    mode: 'Incremental'
+    template: {
+      '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
+      contentVersion: '1.0.0.0'
+      resources: []
+      outputs: {
+        telemetry: {
+          type: 'String'
+          value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
+        }
+      }
+    }
+  }
+}
+
+module containerAppsEnvironment 'br/public:avm/res/app/managed-environment:0.7.0' = {
+  name: take('containerAppsEnvironment-${deployment().name}-deployment', 64)
+  params: {
+    name: containerAppsEnvironmentName
+    location: location
+    tags: tags
+    daprAIInstrumentationKey: daprAIInstrumentationKey
+    logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
+    appInsightsConnectionString: appInsightsConnectionString
+    zoneRedundant: zoneRedundant
+    workloadProfiles: workloadProfiles
+    infrastructureResourceGroupName: infrastructureResourceGroupName
+    internal: internal
+    infrastructureSubnetId: infrastructureSubnetResourceId
+    dockerBridgeCidr: dockerBridgeCidr
+    platformReservedCidr: platformReservedCidr
+    platformReservedDnsIP: platformReservedDnsIP
+  }
+}
+
+module containerRegistry 'br/public:avm/res/container-registry/registry:0.4.0' = {
+  name: take('containerRegistry-${deployment().name}-deployment', 64)
+  scope: !empty(containerRegistryResourceGroupName)
+    ? resourceGroup(containerRegistryResourceGroupName)
+    : resourceGroup()
+  params: {
+    name: containerRegistryName
+    location: location
+    acrAdminUserEnabled: acrAdminUserEnabled
+    tags: tags
+    acrSku: acrSku
+  }
+}
+
+@description('The name of the resource group the all resources was deployed into.')
+output resourceGroupName string = resourceGroup().name
+
+@description('The Default domain of the Managed Environment.')
+output defaultDomain string = containerAppsEnvironment.outputs.defaultDomain
+
+@description('The name of the Managed Environment.')
+output environmentName string = containerAppsEnvironment.outputs.name
+
+@description('The resource ID of the Managed Environment.')
+output environmentResourceId string = containerAppsEnvironment.outputs.resourceId
+
+@description('The reference to the Azure container registry.')
+output registryLoginServer string = containerRegistry.outputs.loginServer
+
+@description('The Name of the Azure container registry.')
+output registryName string = containerRegistry.outputs.name
diff --git a/avm/ptn/azd/container-apps/main.json b/avm/ptn/azd/container-apps/main.json
new file mode 100644
index 0000000000..b781ce346e
--- /dev/null
+++ b/avm/ptn/azd/container-apps/main.json
@@ -0,0 +1,3337 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.28.1.47646",
+      "templateHash": "3154922260961626340"
+    },
+    "name": "avm/ptn/azd/container-apps",
+    "description": "Creates an Azure Container Registry and an Azure Container Apps environment.",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Optional. Location for all Resources."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Tags of the resource."
+      }
+    },
+    "containerAppsEnvironmentName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Name of the Container Apps Managed Environment."
+      }
+    },
+    "containerRegistryName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Name of the Azure Container Registry."
+      }
+    },
+    "containerRegistryResourceGroupName": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Name of the Azure Container Registry Resource Group."
+      }
+    },
+    "acrAdminUserEnabled": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable admin user that have push / pull permission to the registry."
+      }
+    },
+    "logAnalyticsWorkspaceResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990)."
+      }
+    },
+    "appInsightsConnectionString": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Application Insights connection string."
+      }
+    },
+    "daprAIInstrumentationKey": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
+      }
+    },
+    "acrSku": {
+      "type": "string",
+      "defaultValue": "Standard",
+      "allowedValues": [
+        "Basic",
+        "Premium",
+        "Standard"
+      ],
+      "metadata": {
+        "description": "Optional. SKU settings. Default is \"Standard\"."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for module."
+      }
+    },
+    "zoneRedundant": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Zone redundancy setting."
+      }
+    },
+    "dockerBridgeCidr": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+      }
+    },
+    "infrastructureSubnetResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
+      }
+    },
+    "internal": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
+      }
+    },
+    "platformReservedCidr": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
+      }
+    },
+    "platformReservedDnsIP": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+      }
+    },
+    "workloadProfiles": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
+      }
+    },
+    "infrastructureResourceGroupName": {
+      "type": "string",
+      "defaultValue": "[take(format('ME_{0}', parameters('containerAppsEnvironmentName')), 63)]",
+      "metadata": {
+        "description": "Optional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
+      }
+    }
+  },
+  "resources": {
+    "avmTelemetry": {
+      "condition": "[parameters('enableTelemetry')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2023-07-01",
+      "name": "[format('46d3xbcp.ptn.azd-containerapps.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+      "properties": {
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "resources": [],
+          "outputs": {
+            "telemetry": {
+              "type": "String",
+              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+            }
+          }
+        }
+      }
+    },
+    "containerAppsEnvironment": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('containerAppsEnvironment-{0}-deployment', deployment().name), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[parameters('containerAppsEnvironmentName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "daprAIInstrumentationKey": {
+            "value": "[parameters('daprAIInstrumentationKey')]"
+          },
+          "logAnalyticsWorkspaceResourceId": {
+            "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
+          },
+          "appInsightsConnectionString": {
+            "value": "[parameters('appInsightsConnectionString')]"
+          },
+          "zoneRedundant": {
+            "value": "[parameters('zoneRedundant')]"
+          },
+          "workloadProfiles": {
+            "value": "[parameters('workloadProfiles')]"
+          },
+          "infrastructureResourceGroupName": {
+            "value": "[parameters('infrastructureResourceGroupName')]"
+          },
+          "internal": {
+            "value": "[parameters('internal')]"
+          },
+          "infrastructureSubnetId": {
+            "value": "[parameters('infrastructureSubnetResourceId')]"
+          },
+          "dockerBridgeCidr": {
+            "value": "[parameters('dockerBridgeCidr')]"
+          },
+          "platformReservedCidr": {
+            "value": "[parameters('platformReservedCidr')]"
+          },
+          "platformReservedDnsIP": {
+            "value": "[parameters('platformReservedDnsIP')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "8714567000770152884"
+            },
+            "name": "App ManagedEnvironments",
+            "description": "This module deploys an App Managed Environment (also known as a Container App Environment).",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "storageType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "accessMode": {
+                    "type": "string",
+                    "allowedValues": [
+                      "ReadOnly",
+                      "ReadWrite"
+                    ],
+                    "metadata": {
+                      "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
+                    }
+                  },
+                  "kind": {
+                    "type": "string",
+                    "allowedValues": [
+                      "NFS",
+                      "SMB"
+                    ],
+                    "metadata": {
+                      "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
+                    }
+                  },
+                  "storageAccountName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Storage account name."
+                    }
+                  },
+                  "shareName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. File share name."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Container Apps Managed Environment."
+              }
+            },
+            "logAnalyticsWorkspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990)."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all Resources."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "logsDestination": {
+              "type": "string",
+              "defaultValue": "log-analytics",
+              "metadata": {
+                "description": "Optional. Logs destination."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "appInsightsConnectionString": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Application Insights connection string."
+              }
+            },
+            "daprAIConnectionString": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
+              }
+            },
+            "daprAIInstrumentationKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
+              }
+            },
+            "dockerBridgeCidr": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+              }
+            },
+            "infrastructureSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
+              }
+            },
+            "internal": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
+              }
+            },
+            "platformReservedCidr": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
+              }
+            },
+            "platformReservedDnsIP": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+              }
+            },
+            "peerTrafficEncryption": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether or not to encrypt peer traffic."
+              }
+            },
+            "zoneRedundant": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether or not this Managed Environment is zone-redundant."
+              }
+            },
+            "certificatePassword": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Password of the certificate used by the custom domain."
+              }
+            },
+            "certificateValue": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
+              }
+            },
+            "dnsSuffix": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. DNS suffix for the environment domain."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "openTelemetryConfiguration": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Open Telemetry configuration."
+              }
+            },
+            "workloadProfiles": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
+              }
+            },
+            "infrastructureResourceGroupName": {
+              "type": "string",
+              "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
+              "metadata": {
+                "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
+              }
+            },
+            "storages": {
+              "$ref": "#/definitions/storageType",
+              "metadata": {
+                "description": "Optional. The list of storages to mount on the environment."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "managedEnvironment::storage": {
+              "copy": {
+                "name": "storage",
+                "count": "[length(coalesce(parameters('storages'), createArray()))]"
+              },
+              "type": "Microsoft.App/managedEnvironments/storages",
+              "apiVersion": "2024-02-02-preview",
+              "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
+              "properties": {
+                "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
+                "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
+              },
+              "dependsOn": [
+                "managedEnvironment"
+              ]
+            },
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "logAnalyticsWorkspace": {
+              "condition": "[not(empty(parameters('logAnalyticsWorkspaceResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.OperationalInsights/workspaces",
+              "apiVersion": "2023-09-01",
+              "subscriptionId": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2]]",
+              "resourceGroup": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]]",
+              "name": "[last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))]"
+            },
+            "managedEnvironment": {
+              "type": "Microsoft.App/managedEnvironments",
+              "apiVersion": "2024-02-02-preview",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "identity": "[variables('identity')]",
+              "properties": {
+                "appInsightsConfiguration": {
+                  "connectionString": "[parameters('appInsightsConnectionString')]"
+                },
+                "appLogsConfiguration": {
+                  "destination": "[parameters('logsDestination')]",
+                  "logAnalyticsConfiguration": {
+                    "customerId": "[reference('logAnalyticsWorkspace').customerId]",
+                    "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))), '2023-09-01').primarySharedKey]"
+                  }
+                },
+                "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
+                "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
+                "customDomainConfiguration": {
+                  "certificatePassword": "[parameters('certificatePassword')]",
+                  "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
+                  "dnsSuffix": "[parameters('dnsSuffix')]"
+                },
+                "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
+                "peerTrafficConfiguration": {
+                  "encryption": {
+                    "enabled": "[parameters('peerTrafficEncryption')]"
+                  }
+                },
+                "vnetConfiguration": {
+                  "internal": "[parameters('internal')]",
+                  "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('infrastructureSubnetId'), null())]",
+                  "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('dockerBridgeCidr'), null())]",
+                  "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedCidr'), null())]",
+                  "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedDnsIP'), null())]"
+                },
+                "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
+                "zoneRedundant": "[parameters('zoneRedundant')]",
+                "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
+              },
+              "dependsOn": [
+                "logAnalyticsWorkspace"
+              ]
+            },
+            "managedEnvironment_roleAssignments": {
+              "copy": {
+                "name": "managedEnvironment_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "managedEnvironment"
+              ]
+            },
+            "managedEnvironment_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "managedEnvironment"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the resource group the Managed Environment was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('managedEnvironment', '2024-02-02-preview', 'full').location]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Managed Environment."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Managed Environment."
+              },
+              "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('managedEnvironment', '2024-02-02-preview', 'full'), 'identity'), 'principalId'), '')]"
+            },
+            "defaultDomain": {
+              "type": "string",
+              "metadata": {
+                "description": "The Default domain of the Managed Environment."
+              },
+              "value": "[reference('managedEnvironment').defaultDomain]"
+            },
+            "staticIp": {
+              "type": "string",
+              "metadata": {
+                "description": "The IP address of the Managed Environment."
+              },
+              "value": "[reference('managedEnvironment').staticIp]"
+            }
+          }
+        }
+      }
+    },
+    "containerRegistry": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[take(format('containerRegistry-{0}-deployment', deployment().name), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[parameters('containerRegistryName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "acrAdminUserEnabled": {
+            "value": "[parameters('acrAdminUserEnabled')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "acrSku": {
+            "value": "[parameters('acrSku')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "8799580877381308457"
+            },
+            "name": "Azure Container Registries (ACR)",
+            "description": "This module deploys an Azure Container Registry (ACR).",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "roleAssignmentType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
+                  "roleDefinitionIdOrName": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                    }
+                  },
+                  "principalId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                    }
+                  },
+                  "principalType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Device",
+                      "ForeignGroup",
+                      "Group",
+                      "ServicePrincipal",
+                      "User"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The principal type of the assigned principal ID."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The description of the role assignment."
+                    }
+                  },
+                  "condition": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                    }
+                  },
+                  "conditionVersion": {
+                    "type": "string",
+                    "allowedValues": [
+                      "2.0"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Version of the condition."
+                    }
+                  },
+                  "delegatedManagedIdentityResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The Resource Id of the delegated managed identity resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "privateEndpointType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private endpoint."
+                    }
+                  },
+                  "location": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The location to deploy the private endpoint to."
+                    }
+                  },
+                  "privateLinkServiceConnectionName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private link connection to create."
+                    }
+                  },
+                  "service": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+                    }
+                  },
+                  "subnetResourceId": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                    }
+                  },
+                  "privateDnsZoneGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                    }
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                    }
+                  },
+                  "isManualConnection": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. If Manual Private Link Connection is required."
+                    }
+                  },
+                  "manualConnectionRequestMessage": {
+                    "type": "string",
+                    "nullable": true,
+                    "maxLength": 140,
+                    "metadata": {
+                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                    }
+                  },
+                  "customDnsConfigs": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Required. Fqdn that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Custom DNS configurations."
+                    }
+                  },
+                  "ipConfigurations": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                    }
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                    }
+                  },
+                  "customNetworkInterfaceName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                    }
+                  },
+                  "lock": {
+                    "$ref": "#/definitions/lockType",
+                    "metadata": {
+                      "description": "Optional. Specify the type of lock."
+                    }
+                  },
+                  "roleAssignments": {
+                    "$ref": "#/definitions/roleAssignmentType",
+                    "metadata": {
+                      "description": "Optional. Array of role assignments to create."
+                    }
+                  },
+                  "tags": {
+                    "type": "object",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                    }
+                  },
+                  "enableTelemetry": {
+                    "type": "bool",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Enable/Disable usage telemetry for module."
+                    }
+                  },
+                  "resourceGroupName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "diagnosticSettingType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of diagnostic setting."
+                    }
+                  },
+                  "logCategoriesAndGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                          }
+                        },
+                        "categoryGroup": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                    }
+                  },
+                  "metricCategories": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                          }
+                        }
+                      }
+                    },
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                    }
+                  },
+                  "logAnalyticsDestinationType": {
+                    "type": "string",
+                    "allowedValues": [
+                      "AzureDiagnostics",
+                      "Dedicated"
+                    ],
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                    }
+                  },
+                  "workspaceResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "storageAccountResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "eventHubAuthorizationRuleResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                    }
+                  },
+                  "eventHubName": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                    }
+                  },
+                  "marketplacePartnerResourceId": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "customerManagedKeyType": {
+              "type": "object",
+              "properties": {
+                "keyVaultResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                  }
+                },
+                "keyName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the customer managed key to use for encryption."
+                  }
+                },
+                "keyVersion": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'."
+                  }
+                },
+                "userAssignedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                  }
+                }
+              },
+              "nullable": true
+            },
+            "scopeMapsType": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name of the scope map."
+                    }
+                  },
+                  "actions": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "metadata": {
+                      "description": "Required. The list of scoped permissions for registry artifacts."
+                    }
+                  },
+                  "description": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The user friendly description of the scope map."
+                    }
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "minLength": 5,
+              "maxLength": 50,
+              "metadata": {
+                "description": "Required. Name of your Azure Container Registry."
+              }
+            },
+            "acrAdminUserEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enable admin user that have push / pull permission to the registry."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "roleAssignments": {
+              "$ref": "#/definitions/roleAssignmentType",
+              "metadata": {
+                "description": "Optional. Array of role assignments to create."
+              }
+            },
+            "acrSku": {
+              "type": "string",
+              "defaultValue": "Basic",
+              "allowedValues": [
+                "Basic",
+                "Premium",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. Tier of your Azure container registry."
+              }
+            },
+            "exportPolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the export policy is enabled or not."
+              }
+            },
+            "quarantinePolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "trustPolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "retentionPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+              }
+            },
+            "retentionPolicyDays": {
+              "type": "int",
+              "defaultValue": 15,
+              "metadata": {
+                "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
+              }
+            },
+            "azureADAuthenticationAsArmPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registr is enabled or not. Default is enabled."
+              }
+            },
+            "softDeletePolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "allowedValues": [
+                "disabled",
+                "enabled"
+              ],
+              "metadata": {
+                "description": "Optional. Soft Delete policy status. Default is disabled."
+              }
+            },
+            "softDeletePolicyDays": {
+              "type": "int",
+              "defaultValue": 7,
+              "metadata": {
+                "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
+              }
+            },
+            "dataEndpointEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "networkRuleBypassOptions": {
+              "type": "string",
+              "defaultValue": "AzureServices",
+              "allowedValues": [
+                "AzureServices",
+                "None"
+              ],
+              "metadata": {
+                "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
+              }
+            },
+            "networkRuleSetDefaultAction": {
+              "type": "string",
+              "defaultValue": "Deny",
+              "allowedValues": [
+                "Allow",
+                "Deny"
+              ],
+              "metadata": {
+                "description": "Optional. The default action of allow or deny when no other rules match."
+              }
+            },
+            "networkRuleSetIpRules": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "privateEndpoints": {
+              "$ref": "#/definitions/privateEndpointType",
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
+              }
+            },
+            "zoneRedundancy": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Disabled",
+                "Enabled"
+              ],
+              "metadata": {
+                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+              }
+            },
+            "replications": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. All replications to create."
+              }
+            },
+            "webhooks": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. All webhooks to create."
+              }
+            },
+            "lock": {
+              "$ref": "#/definitions/lockType",
+              "metadata": {
+                "description": "Optional. The lock settings of the service."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "$ref": "#/definitions/diagnosticSettingType",
+              "metadata": {
+                "description": "Optional. The diagnostic settings of the service."
+              }
+            },
+            "anonymousPullEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+              }
+            },
+            "customerManagedKey": {
+              "$ref": "#/definitions/customerManagedKeyType",
+              "metadata": {
+                "description": "Optional. The customer managed key definition."
+              }
+            },
+            "cacheRules": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of Cache Rules."
+              }
+            },
+            "credentialSets": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Array of Credential Sets."
+              }
+            },
+            "scopeMaps": {
+              "$ref": "#/definitions/scopeMapsType",
+              "metadata": {
+                "description": "Optional. Scope maps setting."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+            "builtInRoleNames": {
+              "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
+              "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
+              "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
+              "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
+              "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
+              "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
+              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+            }
+          },
+          "resources": {
+            "cMKKeyVault::cMKKey": {
+              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults/keys",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[format('{0}/{1}', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/')), coalesce(tryGet(parameters('customerManagedKey'), 'keyName'), 'dummyKey'))]",
+              "dependsOn": [
+                "cMKKeyVault"
+              ]
+            },
+            "avmTelemetry": {
+              "condition": "[parameters('enableTelemetry')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "properties": {
+                "mode": "Incremental",
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "resources": [],
+                  "outputs": {
+                    "telemetry": {
+                      "type": "String",
+                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                    }
+                  }
+                }
+              }
+            },
+            "cMKKeyVault": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2023-02-01",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), 'dummyVault'), '/'))]"
+            },
+            "cMKUserAssignedIdentity": {
+              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+              "existing": true,
+              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+              "apiVersion": "2023-01-31",
+              "subscriptionId": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2]]",
+              "resourceGroup": "[split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]]",
+              "name": "[last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))]"
+            },
+            "registry": {
+              "type": "Microsoft.ContainerRegistry/registries",
+              "apiVersion": "2023-06-01-preview",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "identity": "[variables('identity')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('acrSku')]"
+              },
+              "properties": {
+                "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
+                "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
+                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), reference('cMKKeyVault::cMKKey').keyUriWithVersion))), null())]",
+                "policies": {
+                  "azureADAuthenticationAsArmPolicy": {
+                    "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                  },
+                  "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
+                  "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
+                  "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
+                  "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
+                  "softDeletePolicy": {
+                    "retentionDays": "[parameters('softDeletePolicyDays')]",
+                    "status": "[parameters('softDeletePolicyStatus')]"
+                  }
+                },
+                "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
+                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
+                "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+                "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]",
+                "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
+              },
+              "dependsOn": [
+                "cMKKeyVault",
+                "cMKUserAssignedIdentity"
+              ]
+            },
+            "registry_lock": {
+              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+              "type": "Microsoft.Authorization/locks",
+              "apiVersion": "2020-05-01",
+              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+              "properties": {
+                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_diagnosticSettings": {
+              "copy": {
+                "name": "registry_diagnosticSettings",
+                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+              },
+              "type": "Microsoft.Insights/diagnosticSettings",
+              "apiVersion": "2021-05-01-preview",
+              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+              "properties": {
+                "copy": [
+                  {
+                    "name": "metrics",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                    "input": {
+                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                      "timeGrain": null
+                    }
+                  },
+                  {
+                    "name": "logs",
+                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                    "input": {
+                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    }
+                  }
+                ],
+                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_roleAssignments": {
+              "copy": {
+                "name": "registry_roleAssignments",
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+              "properties": {
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_scopeMaps": {
+              "copy": {
+                "name": "registry_scopeMaps",
+                "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]"
+                  },
+                  "actions": {
+                    "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]"
+                  },
+                  "description": {
+                    "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]"
+                  },
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "9144531012597082524"
+                    },
+                    "name": "Container Registries scopeMaps",
+                    "description": "This module deploys an Azure Container Registry (ACR) scopeMap.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]",
+                      "metadata": {
+                        "description": "Optional. The name of the scope map."
+                      }
+                    },
+                    "actions": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "metadata": {
+                        "description": "Required. The list of scoped permissions for registry artifacts."
+                      }
+                    },
+                    "description": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The user friendly description of the scope map."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "scopeMap": {
+                      "type": "Microsoft.ContainerRegistry/registries/scopeMaps",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "properties": {
+                        "actions": "[parameters('actions')]",
+                        "description": "[parameters('description')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the scope map."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the scope map was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the scope map."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_replications": {
+              "copy": {
+                "name": "registry_replications",
+                "count": "[length(coalesce(parameters('replications'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
+                  },
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
+                  },
+                  "regionEndpointEnabled": {
+                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+                  },
+                  "zoneRedundancy": {
+                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "8531695368487734118"
+                    },
+                    "name": "Azure Container Registry (ACR) Replications",
+                    "description": "This module deploys an Azure Container Registry (ACR) Replication.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the replication."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "regionEndpointEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                      }
+                    },
+                    "zoneRedundancy": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "replication": {
+                      "type": "Microsoft.ContainerRegistry/registries/replications",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
+                        "zoneRedundancy": "[parameters('zoneRedundancy')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the replication."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the replication."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the replication was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('replication', '2023-06-01-preview', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_credentialSets": {
+              "copy": {
+                "name": "registry_credentialSets",
+                "count": "[length(coalesce(parameters('credentialSets'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]"
+                  },
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]"
+                  },
+                  "authCredentials": {
+                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]"
+                  },
+                  "loginServer": {
+                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "12196074162662855376"
+                    },
+                    "name": "Container Registries Credential Sets",
+                    "description": "This module deploys an ACR Credential Set.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "managedIdentitiesType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        }
+                      }
+                    },
+                    "authCredentialsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the credential."
+                            }
+                          },
+                          "usernameSecretIdentifier": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. KeyVault Secret URI for accessing the username."
+                            }
+                          },
+                          "passwordSecretIdentifier": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. KeyVault Secret URI for accessing the password."
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the credential set."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentitiesType",
+                      "metadata": {
+                        "description": "Required. The managed identity definition for this resource."
+                      }
+                    },
+                    "authCredentials": {
+                      "$ref": "#/definitions/authCredentialsType",
+                      "metadata": {
+                        "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                      }
+                    },
+                    "loginServer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The credentials are stored for this upstream or login server."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]"
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "credentialSet": {
+                      "type": "Microsoft.ContainerRegistry/registries/credentialSets",
+                      "apiVersion": "2023-11-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "authCredentials": "[parameters('authCredentials')]",
+                        "loginServer": "[parameters('loginServer')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Name of the Credential Set."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Credential Set."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Credential Set."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('credentialSet', '2023-11-01-preview', 'full'), 'identity'), 'principalId'), '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_cacheRules": {
+              "copy": {
+                "name": "registry_cacheRules",
+                "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "sourceRepository": {
+                    "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
+                  },
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name'), replace(replace(coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository, '/', '-'), '.', '-'))]"
+                  },
+                  "targetRepository": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                  },
+                  "credentialSetResourceId": {
+                    "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "4294329625336671928"
+                    },
+                    "name": "Container Registries Cache",
+                    "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache)).",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-')]",
+                      "metadata": {
+                        "description": "Optional. The name of the cache rule. Will be dereived from the source repository name if not defined."
+                      }
+                    },
+                    "sourceRepository": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Source repository pulled from upstream."
+                      }
+                    },
+                    "targetRepository": {
+                      "type": "string",
+                      "defaultValue": "[parameters('sourceRepository')]",
+                      "metadata": {
+                        "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                      }
+                    },
+                    "credentialSetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource ID of the credential store which is associated with the cache rule."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.ContainerRegistry/registries/cacheRules",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "properties": {
+                        "sourceRepository": "[parameters('sourceRepository')]",
+                        "targetRepository": "[parameters('targetRepository')]",
+                        "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Name of the Cache Rule."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Cache Rule."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Cache Rule."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry",
+                "registry_credentialSets"
+              ]
+            },
+            "registry_webhooks": {
+              "copy": {
+                "name": "registry_webhooks",
+                "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
+                  },
+                  "registryName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                  },
+                  "action": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action'), createArray('chart_delete', 'chart_push', 'delete', 'push', 'quarantine'))]"
+                  },
+                  "customHeaders": {
+                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
+                  },
+                  "scope": {
+                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
+                  },
+                  "status": {
+                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
+                  },
+                  "serviceUri": {
+                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "14912363209364245195"
+                    },
+                    "name": "Azure Container Registry (ACR) Webhooks",
+                    "description": "This module deploys an Azure Container Registry (ACR) Webhook.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "registryName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
+                      "minLength": 5,
+                      "maxLength": 50,
+                      "metadata": {
+                        "description": "Optional. The name of the registry webhook."
+                      }
+                    },
+                    "serviceUri": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The service URI for the webhook to post notifications."
+                      }
+                    },
+                    "status": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The status of the webhook at the time the operation was called."
+                      }
+                    },
+                    "action": {
+                      "type": "array",
+                      "defaultValue": [
+                        "chart_delete",
+                        "chart_push",
+                        "delete",
+                        "push",
+                        "quarantine"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "customHeaders": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom headers that will be added to the webhook notifications."
+                      }
+                    },
+                    "scope": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "registry": {
+                      "existing": true,
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('registryName')]"
+                    },
+                    "webhook": {
+                      "type": "Microsoft.ContainerRegistry/registries/webhooks",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "actions": "[parameters('action')]",
+                        "customHeaders": "[parameters('customHeaders')]",
+                        "scope": "[parameters('scope')]",
+                        "serviceUri": "[parameters('serviceUri')]",
+                        "status": "[parameters('status')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the webhook."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the webhook."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Azure container registry."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "actions": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The actions of the webhook."
+                      },
+                      "value": "[reference('webhook').actions]"
+                    },
+                    "status": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The status of the webhook."
+                      },
+                      "value": "[reference('webhook').status]"
+                    },
+                    "provistioningState": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The provisioning state of the webhook."
+                      },
+                      "value": "[reference('webhook').provisioningState]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('webhook', '2023-06-01-preview', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            },
+            "registry_privateEndpoints": {
+              "copy": {
+                "name": "registry_privateEndpoints",
+                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
+                  },
+                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
+                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                  "subnetResourceId": {
+                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
+                  },
+                  "location": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                  },
+                  "lock": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                  },
+                  "privateDnsZoneGroupName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
+                  },
+                  "privateDnsZoneResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                  },
+                  "tags": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                  },
+                  "customDnsConfigs": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                  },
+                  "ipConfigurations": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                  },
+                  "applicationSecurityGroupResourceIds": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.25.53.49325",
+                      "templateHash": "4120048060064073955"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "definitions": {
+                    "roleAssignmentType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "roleDefinitionIdOrName": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                            }
+                          },
+                          "principalId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                            }
+                          },
+                          "principalType": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Device",
+                              "ForeignGroup",
+                              "Group",
+                              "ServicePrincipal",
+                              "User"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The principal type of the assigned principal ID."
+                            }
+                          },
+                          "description": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The description of the role assignment."
+                            }
+                          },
+                          "condition": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                            }
+                          },
+                          "conditionVersion": {
+                            "type": "string",
+                            "allowedValues": [
+                              "2.0"
+                            ],
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. Version of the condition."
+                            }
+                          },
+                          "delegatedManagedIdentityResourceId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Resource Id of the delegated managed identity resource."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "ipConfigurationsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the resource that is unique within a resource group."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "memberName": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateIPAddress": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private endpoint IP configurations."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "manualPrivateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "privateLinkServiceConnectionsType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. The name of the private link service connection."
+                            }
+                          },
+                          "properties": {
+                            "type": "object",
+                            "properties": {
+                              "groupIds": {
+                                "type": "array",
+                                "metadata": {
+                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                }
+                              },
+                              "privateLinkServiceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of private link service."
+                                }
+                              },
+                              "requestMessage": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                }
+                              }
+                            },
+                            "metadata": {
+                              "description": "Required. Properties of private link service connection."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    },
+                    "customDnsConfigType": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "fqdn": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. Fqdn that resolves to private endpoint IP address."
+                            }
+                          },
+                          "ipAddresses": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. A list of private IP addresses of the private endpoint."
+                            }
+                          }
+                        }
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "$ref": "#/definitions/ipConfigurationsType",
+                      "metadata": {
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      }
+                    },
+                    "privateDnsZoneGroupName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+                      }
+                    },
+                    "privateDnsZoneResourceIds": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "$ref": "#/definitions/roleAssignmentType",
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      }
+                    },
+                    "customDnsConfigs": {
+                      "$ref": "#/definitions/customDnsConfigType",
+                      "metadata": {
+                        "description": "Optional. Custom DNS configurations."
+                      }
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
+                      "metadata": {
+                        "description": "Optional. A grouping of information about the connection to the remote resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2023-07-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        }
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                      "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+                      "properties": {
+                        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+                        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
+                          },
+                          "privateDNSResourceIds": {
+                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.25.53.49325",
+                              "templateHash": "11244630631275470040"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDNSResourceIds": {
+                              "type": "array",
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneConfigs",
+                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                "input": {
+                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                  "properties": {
+                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2023-04-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "registry"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The Name of the Azure container registry."
+              },
+              "value": "[parameters('name')]"
+            },
+            "loginServer": {
+              "type": "string",
+              "metadata": {
+                "description": "The reference to the Azure container registry."
+              },
+              "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2019-05-01').loginServer]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Azure container registry."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Azure container registry."
+              },
+              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId'), '')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('registry', '2023-06-01-preview', 'full').location]"
+            },
+            "credentialSetsSystemAssignedMIPrincipalIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The Principal IDs of the ACR Credential Sets system-assigned identities."
+              },
+              "copy": {
+                "count": "[length(range(0, length(parameters('credentialSets'))))]",
+                "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(parameters('credentialSets')))[copyIndex()])).outputs.systemAssignedMIPrincipalId.value]"
+              }
+            },
+            "credentialSetsResourceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The Resource IDs of the ACR Credential Sets."
+              },
+              "copy": {
+                "count": "[length(range(0, length(parameters('credentialSets'))))]",
+                "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(parameters('credentialSets')))[copyIndex()])).outputs.resourceId.value]"
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "outputs": {
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the resource group the all resources was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    },
+    "defaultDomain": {
+      "type": "string",
+      "metadata": {
+        "description": "The Default domain of the Managed Environment."
+      },
+      "value": "[reference('containerAppsEnvironment').outputs.defaultDomain.value]"
+    },
+    "environmentName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Managed Environment."
+      },
+      "value": "[reference('containerAppsEnvironment').outputs.name.value]"
+    },
+    "environmentResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Managed Environment."
+      },
+      "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
+    },
+    "registryLoginServer": {
+      "type": "string",
+      "metadata": {
+        "description": "The reference to the Azure container registry."
+      },
+      "value": "[reference('containerRegistry').outputs.loginServer.value]"
+    },
+    "registryName": {
+      "type": "string",
+      "metadata": {
+        "description": "The Name of the Azure container registry."
+      },
+      "value": "[reference('containerRegistry').outputs.name.value]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/ptn/azd/container-apps/tests/e2e/zone-redundant/dependencies.bicep b/avm/ptn/azd/container-apps/tests/e2e/zone-redundant/dependencies.bicep
new file mode 100644
index 0000000000..4735570581
--- /dev/null
+++ b/avm/ptn/azd/container-apps/tests/e2e/zone-redundant/dependencies.bicep
@@ -0,0 +1,58 @@
+@description('Optional. The location to deploy resources to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Log Analytics Workspace to create.')
+param logAnalyticsWorkspaceName string
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+var addressPrefix = '10.0.0.0/16'
+
+resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
+  name: logAnalyticsWorkspaceName
+  location: location
+  properties: {
+    retentionInDays: 30
+    features: {
+      searchVersion: 1
+    }
+    sku: {
+      name: 'PerGB2018'
+    }
+  }
+}
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+          delegations: [
+            {
+              name: 'Microsoft.App.environments'
+              properties: {
+                serviceName: 'Microsoft.App/environments'
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
+
+@description('The resource ID of the created Virtual Network Subnet.')
+output subnetResourceId string = virtualNetwork.properties.subnets[0].id
+
+@description('The resource ID of the created Log Analytics Workspace.')
+output logAnalyticsWorkspaceResourceId string = logAnalyticsWorkspace.id
diff --git a/avm/ptn/azd/container-apps/tests/e2e/zone-redundant/main.test.bicep b/avm/ptn/azd/container-apps/tests/e2e/zone-redundant/main.test.bicep
new file mode 100644
index 0000000000..19ec8ef14a
--- /dev/null
+++ b/avm/ptn/azd/container-apps/tests/e2e/zone-redundant/main.test.bicep
@@ -0,0 +1,75 @@
+targetScope = 'subscription'
+
+metadata name = 'With zoneRedundant enabled'
+metadata description = 'This instance deploys the module with zoneRedundant enabled.'
+
+// ========== //
+// Parameters //
+// ========== //
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-container-apps-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'acazr'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    location: resourceLocation
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    logAnalyticsWorkspaceName: 'dep-${namePrefix}-law-${serviceShort}'
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      containerAppsEnvironmentName: '${namePrefix}${serviceShort}cae001'
+      containerRegistryName: '${namePrefix}${serviceShort}cr001'
+      logAnalyticsWorkspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+      location: resourceLocation
+      acrSku: 'Standard'
+      zoneRedundant: true
+      workloadProfiles: [
+        {
+          workloadProfileType: 'D4'
+          name: 'CAW01'
+          minimumCount: 0
+          maximumCount: 3
+        }
+      ]
+      internal: true
+      dockerBridgeCidr: '172.16.0.1/28'
+      platformReservedCidr: '172.17.17.0/24'
+      platformReservedDnsIP: '172.17.17.17'
+      infrastructureSubnetResourceId: nestedDependencies.outputs.subnetResourceId
+      infrastructureResourceGroupName: 'me-${resourceGroupName}'
+    }
+  }
+]
diff --git a/avm/ptn/azd/container-apps/version.json b/avm/ptn/azd/container-apps/version.json
new file mode 100644
index 0000000000..8def869ede
--- /dev/null
+++ b/avm/ptn/azd/container-apps/version.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
+  "version": "0.1",
+  "pathFilters": [
+    "./main.json"
+  ]
+}
diff --git a/avm/ptn/deployment-script/import-image-to-acr/README.md b/avm/ptn/deployment-script/import-image-to-acr/README.md
index 66fed581f5..b079fe65c1 100644
--- a/avm/ptn/deployment-script/import-image-to-acr/README.md
+++ b/avm/ptn/deployment-script/import-image-to-acr/README.md
@@ -52,7 +52,7 @@ module importImageToAcr 'br/public:avm/ptn/deployment-script/import-image-to-acr
     name: 'dsiitamin001'
     // Non-required parameters
     location: '<location>'
-    overwriteExistingImage: '<overwriteExistingImage>'
+    overwriteExistingImage: true
   }
 }
 ```
@@ -84,7 +84,7 @@ module importImageToAcr 'br/public:avm/ptn/deployment-script/import-image-to-acr
       "value": "<location>"
     },
     "overwriteExistingImage": {
-      "value": "<overwriteExistingImage>"
+      "value": true
     }
   }
 }
diff --git a/avm/ptn/finops-toolkit/finops-hub/main.bicep b/avm/ptn/finops-toolkit/finops-hub/main.bicep
index c96c07fcce..68a4bb56d2 100644
--- a/avm/ptn/finops-toolkit/finops-hub/main.bicep
+++ b/avm/ptn/finops-toolkit/finops-hub/main.bicep
@@ -99,10 +99,7 @@ module storage 'modules/storage.bicep' = {
 resource dataFactory 'Microsoft.DataFactory/factories@2018-06-01' = {
   name: dataFactoryName
   location: location
-  tags: union(
-    resourceTags,
-    contains(tagsByResource, 'Microsoft.DataFactory/factories') ? tagsByResource['Microsoft.DataFactory/factories'] : {}
-  )
+  tags: union(resourceTags, tagsByResource[?'Microsoft.DataFactory/factories'] ?? {})
   identity: { type: 'SystemAssigned' }
   properties: any(
     // Using any() to hide the error that gets surfaced because globalConfigurations is not in the ADF schema yet.
@@ -174,6 +171,7 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
   }
 }
 
+#disable-next-line no-deployments-resources
 resource defaultTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) {
   name: 'pid-${telemetryId}-${uniqueString(deployment().name, location)}'
   properties: {
diff --git a/avm/ptn/finops-toolkit/finops-hub/main.json b/avm/ptn/finops-toolkit/finops-hub/main.json
index e8fb5815b2..3cf86b2d5e 100644
--- a/avm/ptn/finops-toolkit/finops-hub/main.json
+++ b/avm/ptn/finops-toolkit/finops-hub/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "13514907472495855174"
+      "version": "0.29.47.4906",
+      "templateHash": "2378205016082649078"
     },
     "name": "Finops-hub",
     "description": "This module deploys a Finops hub from the Finops toolkit.",
@@ -112,7 +112,7 @@
       "apiVersion": "2018-06-01",
       "name": "[variables('dataFactoryName')]",
       "location": "[parameters('location')]",
-      "tags": "[union(variables('resourceTags'), if(contains(parameters('tagsByResource'), 'Microsoft.DataFactory/factories'), parameters('tagsByResource')['Microsoft.DataFactory/factories'], createObject()))]",
+      "tags": "[union(variables('resourceTags'), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.DataFactory/factories'), createObject()))]",
       "identity": {
         "type": "SystemAssigned"
       },
@@ -210,8 +210,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "7548608522101382905"
+              "version": "0.29.47.4906",
+              "templateHash": "4568813132024947706"
             }
           },
           "parameters": {
@@ -291,14 +291,14 @@
             }
           },
           "variables": {
-            "$fxv#0": "Write-Output 'Updating settings.json file...'\r\nWrite-Output \"Storage account: $env:storageAccountName\"\r\nWrite-Output \"Container: $env:containerName\"\r\n\r\n$validateScopes = { $_.Length -gt 45 }\r\n\r\n# Initialize variables\r\n$fileName = 'settings.json'\r\n$filePath = Join-Path -Path . -ChildPath $fileName\r\n$newScopes = $env:exportScopes.Split('|') | Where-Object $validateScopes | ForEach-Object { @{ scope = $_ } }\r\n\r\n# Get storage context\r\n$storageContext = @{\r\n  Context   = New-AzStorageContext -StorageAccountName $env:storageAccountName -UseConnectedAccount\r\n  Container = $env:containerName\r\n}\r\n\r\n# Download existing settings, if they exist\r\n$blob = Get-AzStorageBlobContent @storageContext -Blob $fileName -Destination $filePath -Force\r\nif ($blob) {\r\n  Write-Output 'Existing settings.json file found. Updating...'\r\n  $text = Get-Content $filePath -Raw\r\n  Write-Output '---------'\r\n  Write-Output $text\r\n  Write-Output '---------'\r\n  $json = $text | ConvertFrom-Json\r\n\r\n  # Rename exportScopes to scopes + convert to object array\r\n  if ($json.exportScopes) {\r\n    Write-Output '  Updating exportScopes...'\r\n    if ($json.exportScopes[0] -is [string]) {\r\n      Write-Output '    Converting string array to object array...'\r\n      $json.exportScopes = $json.exportScopes | Where-Object $validateScopes | ForEach-Object { @{ scope = $_ } }\r\n      if (-not ($json.exportScopes -is [array])) {\r\n        Write-Output '    Converting single object to object array...'\r\n        $json.exportScopes = @($json.exportScopes)\r\n      }\r\n    }\r\n\r\n    Write-Output \"    Renaming to 'scopes'...\"\r\n    $json | Add-Member -MemberType NoteProperty -Name scopes -Value $json.exportScopes\r\n    $json.PSObject.Properties.Remove('exportScopes')\r\n  }\r\n}\r\n\r\n# Set default if not found\r\nif (!$json) {\r\n  Write-Output 'No existing settings.json file found. Creating new file...'\r\n  $json = [ordered]@{\r\n    '$schema' = 'https://aka.ms/finops/hubs/settings-schema'\r\n    type      = 'HubInstance'\r\n    version   = ''\r\n    learnMore = 'https://aka.ms/finops/hubs'\r\n    scopes    = @()\r\n  }\r\n}\r\n\r\n# Updating settings\r\nWrite-Output \"Updating version to $env:ftkVersion...\"\r\n$json.version = $env:ftkVersion\r\nif ($newScopes) {\r\n  Write-Output \"Merging $($newScopes.Count) scopes...\"\r\n  $json.scopes = Compare-Object -ReferenceObject $json.scopes -DifferenceObject $newScopes -Property scope -PassThru -IncludeEqual\r\n\r\n  # Remove the SideIndicator property from the Compare-Object output\r\n  $json.scopes | ForEach-Object { $_.PSObject.Properties.Remove('SideIndicator') } | ConvertTo-Json\r\n\r\n  if (-not ($json.scopes -is [array])) {\r\n    $json.scopes = @($json.scopes)\r\n  }\r\n  Write-Output \"$($json.scopes.Count) scopes found.\"\r\n}\r\n$text = $json | ConvertTo-Json\r\nWrite-Output '---------'\r\nWrite-Output $text\r\nWrite-Output '---------'\r\n$text | Out-File $filePath\r\n\r\n# Upload new/updated settings\r\nWrite-Output 'Uploading settings.json file...'\r\nSet-AzStorageBlobContent @storageContext -File $filePath -Force\r\n"
+            "$fxv#0": "Write-Output 'Updating settings.json file...'\nWrite-Output \"Storage account: $env:storageAccountName\"\nWrite-Output \"Container: $env:containerName\"\n\n$validateScopes = { $_.Length -gt 45 }\n\n# Initialize variables\n$fileName = 'settings.json'\n$filePath = Join-Path -Path . -ChildPath $fileName\n$newScopes = $env:exportScopes.Split('|') | Where-Object $validateScopes | ForEach-Object { @{ scope = $_ } }\n\n# Get storage context\n$storageContext = @{\n    Context   = New-AzStorageContext -StorageAccountName $env:storageAccountName -UseConnectedAccount\n    Container = $env:containerName\n}\n\n# Download existing settings, if they exist\n$blob = Get-AzStorageBlobContent @storageContext -Blob $fileName -Destination $filePath -Force\nif ($blob) {\n    Write-Output 'Existing settings.json file found. Updating...'\n    $text = Get-Content $filePath -Raw\n    Write-Output '---------'\n    Write-Output $text\n    Write-Output '---------'\n    $json = $text | ConvertFrom-Json\n\n    # Rename exportScopes to scopes + convert to object array\n    if ($json.exportScopes) {\n        Write-Output '  Updating exportScopes...'\n        if ($json.exportScopes[0] -is [string]) {\n            Write-Output '    Converting string array to object array...'\n            $json.exportScopes = $json.exportScopes | Where-Object $validateScopes | ForEach-Object { @{ scope = $_ } }\n            if (-not ($json.exportScopes -is [array])) {\n                Write-Output '    Converting single object to object array...'\n                $json.exportScopes = @($json.exportScopes)\n            }\n        }\n\n        Write-Output \"    Renaming to 'scopes'...\"\n        $json | Add-Member -MemberType NoteProperty -Name scopes -Value $json.exportScopes\n        $json.PSObject.Properties.Remove('exportScopes')\n    }\n}\n\n# Set default if not found\nif (!$json) {\n    Write-Output 'No existing settings.json file found. Creating new file...'\n    $json = [ordered]@{\n        '$schema' = 'https://aka.ms/finops/hubs/settings-schema'\n        type      = 'HubInstance'\n        version   = ''\n        learnMore = 'https://aka.ms/finops/hubs'\n        scopes    = @()\n    }\n}\n\n# Updating settings\nWrite-Output \"Updating version to $env:ftkVersion...\"\n$json.version = $env:ftkVersion\nif ($newScopes) {\n    Write-Output \"Merging $($newScopes.Count) scopes...\"\n    $json.scopes = Compare-Object -ReferenceObject $json.scopes -DifferenceObject $newScopes -Property scope -PassThru -IncludeEqual\n\n    # Remove the SideIndicator property from the Compare-Object output\n    $json.scopes | ForEach-Object { $_.PSObject.Properties.Remove('SideIndicator') } | ConvertTo-Json\n\n    if (-not ($json.scopes -is [array])) {\n        $json.scopes = @($json.scopes)\n    }\n    Write-Output \"$($json.scopes.Count) scopes found.\"\n}\n$text = $json | ConvertTo-Json\nWrite-Output '---------'\nWrite-Output $text\nWrite-Output '---------'\n$text | Out-File $filePath\n\n# Upload new/updated settings\nWrite-Output 'Uploading settings.json file...'\nSet-AzStorageBlobContent @storageContext -File $filePath -Force\n"
           },
           "resources": {
             "identity": {
               "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
               "apiVersion": "2023-01-31",
               "name": "[format('{0}_blobManager', parameters('storageAccountName'))]",
-              "tags": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.ManagedIdentity/userAssignedIdentities'), parameters('tagsByResource')['Microsoft.ManagedIdentity/userAssignedIdentities'], createObject()))]",
+              "tags": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.ManagedIdentity/userAssignedIdentities'), createObject()))]",
               "location": "[parameters('location')]"
             },
             "storageAccount": {
@@ -321,7 +321,7 @@
                     "value": "BlockBlobStorage"
                   },
                   "tags": {
-                    "value": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.Storage/storageAccounts'), parameters('tagsByResource')['Microsoft.Storage/storageAccounts'], createObject()))]"
+                    "value": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.Storage/storageAccounts'), createObject()))]"
                   },
                   "supportsHttpsTrafficOnly": {
                     "value": true
@@ -5027,7 +5027,7 @@
                   },
                   "location": "[if(startsWith(parameters('location'), 'china'), createObject('value', 'chinaeast2'), createObject('value', parameters('location')))]",
                   "tags": {
-                    "value": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.Resources/deploymentScripts'), parameters('tagsByResource')['Microsoft.Resources/deploymentScripts'], createObject()))]"
+                    "value": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.Resources/deploymentScripts'), createObject()))]"
                   },
                   "managedIdentities": {
                     "value": {
@@ -5614,8 +5614,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "13824362730485492490"
+              "version": "0.29.47.4906",
+              "templateHash": "17793535838056076246"
             }
           },
           "parameters": {
@@ -5699,9 +5699,9 @@
                 }
               }
             ],
-            "$fxv#0": "# Init outputs\r\n$DeploymentScriptOutputs = @{}\r\n\r\n$adfParams = @{\r\n  ResourceGroupName = $env:DataFactoryResourceGroup\r\n  DataFactoryName   = $env:DataFactoryName\r\n}\r\n\r\n# Delete old triggers\r\n$triggers = Get-AzDataFactoryV2Trigger @adfParams -ErrorAction SilentlyContinue `\r\n| Where-Object { $_.Name -match '^msexports?$' }\r\n$DeploymentScriptOutputs['stopTriggers'] = $triggers | Stop-AzDataFactoryV2Trigger -Force -ErrorAction SilentlyContinue\r\n$DeploymentScriptOutputs['deleteTriggers'] = $triggers | Remove-AzDataFactoryV2Trigger -Force -ErrorAction SilentlyContinue\r\n\r\n# Delete old pipelines\r\n$DeploymentScriptOutputs['pipelines'] = Get-AzDataFactoryV2Pipeline @adfParams -ErrorAction SilentlyContinue `\r\n| Where-Object { $_.Name -match '^msexports_(extract|transform)$' } `\r\n| Remove-AzDataFactoryV2Pipeline -Force -ErrorAction SilentlyContinue\r\n",
-            "$fxv#1": "Param(\r\n  [switch] $Stop\r\n)\r\n# Init outputs\r\n$DeploymentScriptOutputs = @{}\r\n\r\nif (-not $Stop) {\r\n  Start-Sleep -Seconds 10\r\n}\r\n\r\n# Loop through triggers\r\n$env:Triggers.Split('|') `\r\n| ForEach-Object {\r\n  $trigger = $_\r\n  if ($Stop) {\r\n    Write-Host \"Stopping trigger $trigger...\" -NoNewline\r\n    $triggerOutput = Stop-AzDataFactoryV2Trigger `\r\n      -ResourceGroupName $env:DataFactoryResourceGroup `\r\n      -DataFactoryName $env:DataFactoryName `\r\n      -Name $trigger `\r\n      -Force `\r\n      -ErrorAction SilentlyContinue\r\n  } else {\r\n    Write-Host \"Starting trigger $trigger...\" -NoNewline\r\n    $triggerOutput = Start-AzDataFactoryV2Trigger `\r\n      -ResourceGroupName $env:DataFactoryResourceGroup `\r\n      -DataFactoryName $env:DataFactoryName `\r\n      -Name $trigger `\r\n      -Force\r\n  }\r\n  if ($triggerOutput) {\r\n    Write-Host 'done'\r\n  } else {\r\n    Write-Host 'failed'\r\n  }\r\n  $DeploymentScriptOutputs[$trigger] = $triggerOutput\r\n}\r\n\r\nif ($Stop) {\r\n  Start-Sleep -Seconds 10\r\n}\r\n",
-            "$fxv#2": "Param(\r\n  [switch] $Stop\r\n)\r\n# Init outputs\r\n$DeploymentScriptOutputs = @{}\r\n\r\nif (-not $Stop) {\r\n  Start-Sleep -Seconds 10\r\n}\r\n\r\n# Loop through triggers\r\n$env:Triggers.Split('|') `\r\n| ForEach-Object {\r\n  $trigger = $_\r\n  if ($Stop) {\r\n    Write-Host \"Stopping trigger $trigger...\" -NoNewline\r\n    $triggerOutput = Stop-AzDataFactoryV2Trigger `\r\n      -ResourceGroupName $env:DataFactoryResourceGroup `\r\n      -DataFactoryName $env:DataFactoryName `\r\n      -Name $trigger `\r\n      -Force `\r\n      -ErrorAction SilentlyContinue\r\n  } else {\r\n    Write-Host \"Starting trigger $trigger...\" -NoNewline\r\n    $triggerOutput = Start-AzDataFactoryV2Trigger `\r\n      -ResourceGroupName $env:DataFactoryResourceGroup `\r\n      -DataFactoryName $env:DataFactoryName `\r\n      -Name $trigger `\r\n      -Force\r\n  }\r\n  if ($triggerOutput) {\r\n    Write-Host 'done'\r\n  } else {\r\n    Write-Host 'failed'\r\n  }\r\n  $DeploymentScriptOutputs[$trigger] = $triggerOutput\r\n}\r\n\r\nif ($Stop) {\r\n  Start-Sleep -Seconds 10\r\n}\r\n",
+            "$fxv#0": "# Init outputs\n$DeploymentScriptOutputs = @{}\n\n$adfParams = @{\n    ResourceGroupName = $env:DataFactoryResourceGroup\n    DataFactoryName   = $env:DataFactoryName\n}\n\n# Delete old triggers\n$triggers = Get-AzDataFactoryV2Trigger @adfParams -ErrorAction SilentlyContinue `\n| Where-Object { $_.Name -match '^msexports?$' }\n$DeploymentScriptOutputs['stopTriggers'] = $triggers | Stop-AzDataFactoryV2Trigger -Force -ErrorAction SilentlyContinue\n$DeploymentScriptOutputs['deleteTriggers'] = $triggers | Remove-AzDataFactoryV2Trigger -Force -ErrorAction SilentlyContinue\n\n# Delete old pipelines\n$DeploymentScriptOutputs['pipelines'] = Get-AzDataFactoryV2Pipeline @adfParams -ErrorAction SilentlyContinue `\n| Where-Object { $_.Name -match '^msexports_(extract|transform)$' } `\n| Remove-AzDataFactoryV2Pipeline -Force -ErrorAction SilentlyContinue\n",
+            "$fxv#1": "Param(\n    [switch] $Stop\n)\n# Init outputs\n$DeploymentScriptOutputs = @{}\n\nif (-not $Stop) {\n    Start-Sleep -Seconds 10\n}\n\n# Loop through triggers\n$env:Triggers.Split('|') `\n| ForEach-Object {\n    $trigger = $_\n    if ($Stop) {\n        Write-Host \"Stopping trigger $trigger...\" -NoNewline\n        $triggerOutput = Stop-AzDataFactoryV2Trigger `\n            -ResourceGroupName $env:DataFactoryResourceGroup `\n            -DataFactoryName $env:DataFactoryName `\n            -Name $trigger `\n            -Force `\n            -ErrorAction SilentlyContinue\n    } else {\n        Write-Host \"Starting trigger $trigger...\" -NoNewline\n        $triggerOutput = Start-AzDataFactoryV2Trigger `\n            -ResourceGroupName $env:DataFactoryResourceGroup `\n            -DataFactoryName $env:DataFactoryName `\n            -Name $trigger `\n            -Force\n    }\n    if ($triggerOutput) {\n        Write-Host 'done'\n    } else {\n        Write-Host 'failed'\n    }\n    $DeploymentScriptOutputs[$trigger] = $triggerOutput\n}\n\nif ($Stop) {\n    Start-Sleep -Seconds 10\n}\n",
+            "$fxv#2": "Param(\n    [switch] $Stop\n)\n# Init outputs\n$DeploymentScriptOutputs = @{}\n\nif (-not $Stop) {\n    Start-Sleep -Seconds 10\n}\n\n# Loop through triggers\n$env:Triggers.Split('|') `\n| ForEach-Object {\n    $trigger = $_\n    if ($Stop) {\n        Write-Host \"Stopping trigger $trigger...\" -NoNewline\n        $triggerOutput = Stop-AzDataFactoryV2Trigger `\n            -ResourceGroupName $env:DataFactoryResourceGroup `\n            -DataFactoryName $env:DataFactoryName `\n            -Name $trigger `\n            -Force `\n            -ErrorAction SilentlyContinue\n    } else {\n        Write-Host \"Starting trigger $trigger...\" -NoNewline\n        $triggerOutput = Start-AzDataFactoryV2Trigger `\n            -ResourceGroupName $env:DataFactoryResourceGroup `\n            -DataFactoryName $env:DataFactoryName `\n            -Name $trigger `\n            -Force\n    }\n    if ($triggerOutput) {\n        Write-Host 'done'\n    } else {\n        Write-Host 'failed'\n    }\n    $DeploymentScriptOutputs[$trigger] = $triggerOutput\n}\n\nif ($Stop) {\n    Start-Sleep -Seconds 10\n}\n",
             "datasetPropsDelimitedText": {
               "columnDelimiter": ",",
               "compressionLevel": "Optimal",
@@ -6123,7 +6123,7 @@
               "apiVersion": "2023-01-31",
               "name": "[format('{0}_triggerManager', parameters('dataFactoryName'))]",
               "location": "[parameters('location')]",
-              "tags": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.ManagedIdentity/userAssignedIdentities'), parameters('tagsByResource')['Microsoft.ManagedIdentity/userAssignedIdentities'], createObject()))]"
+              "tags": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.ManagedIdentity/userAssignedIdentities'), createObject()))]"
             },
             "identityRoleAssignments": {
               "copy": {
@@ -7235,7 +7235,7 @@
                     "value": "AzurePowerShell"
                   },
                   "tags": {
-                    "value": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.Resources/deploymentScripts'), parameters('tagsByResource')['Microsoft.Resources/deploymentScripts'], createObject()))]"
+                    "value": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.Resources/deploymentScripts'), createObject()))]"
                   },
                   "azPowerShellVersion": {
                     "value": "9.7"
@@ -7782,7 +7782,7 @@
                     "value": "[parameters('location')]"
                   },
                   "tags": {
-                    "value": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.Resources/deploymentScripts'), parameters('tagsByResource')['Microsoft.Resources/deploymentScripts'], createObject()))]"
+                    "value": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.Resources/deploymentScripts'), createObject()))]"
                   },
                   "kind": {
                     "value": "AzurePowerShell"
@@ -8386,8 +8386,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "2821773295072797810"
+              "version": "0.29.47.4906",
+              "templateHash": "2016642433151139575"
             }
           },
           "parameters": {
@@ -8457,10 +8457,10 @@
                 "name": "formattedAccessPolicies",
                 "count": "[length(parameters('accessPolicies'))]",
                 "input": {
-                  "applicationId": "[if(contains(parameters('accessPolicies')[copyIndex('formattedAccessPolicies')], 'applicationId'), parameters('accessPolicies')[copyIndex('formattedAccessPolicies')].applicationId, '')]",
-                  "objectId": "[if(contains(parameters('accessPolicies')[copyIndex('formattedAccessPolicies')], 'objectId'), parameters('accessPolicies')[copyIndex('formattedAccessPolicies')].objectId, '')]",
+                  "applicationId": "[coalesce(tryGet(parameters('accessPolicies')[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
+                  "objectId": "[coalesce(tryGet(parameters('accessPolicies')[copyIndex('formattedAccessPolicies')], 'objectId'), '')]",
                   "permissions": "[parameters('accessPolicies')[copyIndex('formattedAccessPolicies')].permissions]",
-                  "tenantId": "[if(contains(parameters('accessPolicies')[copyIndex('formattedAccessPolicies')], 'tenantId'), parameters('accessPolicies')[copyIndex('formattedAccessPolicies')].tenantId, tenant().tenantId)]"
+                  "tenantId": "[coalesce(tryGet(parameters('accessPolicies')[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
                 }
               }
             ],
@@ -8492,7 +8492,7 @@
                     "value": "[parameters('location')]"
                   },
                   "tags": {
-                    "value": "[union(coalesce(parameters('tags'), createObject()), if(contains(parameters('tagsByResource'), 'Microsoft.KeyVault/vaults'), parameters('tagsByResource')['Microsoft.KeyVault/vaults'], createObject()))]"
+                    "value": "[union(coalesce(parameters('tags'), createObject()), coalesce(tryGet(parameters('tagsByResource'), 'Microsoft.KeyVault/vaults'), createObject()))]"
                   },
                   "enableVaultForDeployment": {
                     "value": true
diff --git a/avm/ptn/finops-toolkit/finops-hub/modules/dataFactory.bicep b/avm/ptn/finops-toolkit/finops-hub/modules/dataFactory.bicep
index 3e4a79fdbe..61b21125d1 100644
--- a/avm/ptn/finops-toolkit/finops-hub/modules/dataFactory.bicep
+++ b/avm/ptn/finops-toolkit/finops-hub/modules/dataFactory.bicep
@@ -232,12 +232,7 @@ module deleteOldResources 'br/public:avm/res/resources/deployment-script:0.2.0'
 resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
   name: '${dataFactoryName}_triggerManager'
   location: location
-  tags: union(
-    tags ?? {},
-    contains(tagsByResource, 'Microsoft.ManagedIdentity/userAssignedIdentities')
-      ? tagsByResource['Microsoft.ManagedIdentity/userAssignedIdentities']
-      : {}
-  )
+  tags: union(tags ?? {}, tagsByResource[?'Microsoft.ManagedIdentity/userAssignedIdentities'] ?? {})
 }
 
 // Assign access to the identity
@@ -262,12 +257,7 @@ module stopHubTriggers 'br/public:avm/res/resources/deployment-script:0.2.0' = {
     name: 'stopHubTriggers'
     location: location
     kind: 'AzurePowerShell'
-    tags: union(
-      tags ?? {},
-      contains(tagsByResource, 'Microsoft.Resources/deploymentScripts')
-        ? tagsByResource['Microsoft.Resources/deploymentScripts']
-        : {}
-    )
+    tags: union(tags ?? {}, tagsByResource[?'Microsoft.Resources/deploymentScripts'] ?? {})
     azPowerShellVersion: '9.7'
     retentionInterval: 'PT1H'
     cleanupPreference: 'OnSuccess'
@@ -875,12 +865,7 @@ module startHubTriggers 'br/public:avm/res/resources/deployment-script:0.2.0' =
   params: {
     name: 'startHubTriggers'
     location: location
-    tags: union(
-      tags ?? {},
-      contains(tagsByResource, 'Microsoft.Resources/deploymentScripts')
-        ? tagsByResource['Microsoft.Resources/deploymentScripts']
-        : {}
-    )
+    tags: union(tags ?? {}, tagsByResource[?'Microsoft.Resources/deploymentScripts'] ?? {})
     kind: 'AzurePowerShell'
     azPowerShellVersion: '9.7'
     retentionInterval: 'PT1H'
diff --git a/avm/ptn/finops-toolkit/finops-hub/modules/keyVault.bicep b/avm/ptn/finops-toolkit/finops-hub/modules/keyVault.bicep
index 207d944432..491d92b8ef 100644
--- a/avm/ptn/finops-toolkit/finops-hub/modules/keyVault.bicep
+++ b/avm/ptn/finops-toolkit/finops-hub/modules/keyVault.bicep
@@ -41,10 +41,10 @@ var keyVaultName = replace('${take(keyVaultPrefix, 24 - length(keyVaultSuffix))}
 
 var formattedAccessPolicies = [
   for accessPolicy in accessPolicies: {
-    applicationId: contains(accessPolicy, 'applicationId') ? accessPolicy.applicationId : ''
-    objectId: contains(accessPolicy, 'objectId') ? accessPolicy.objectId : ''
+    applicationId: accessPolicy.?applicationId ?? ''
+    objectId: accessPolicy.?objectId ?? ''
     permissions: accessPolicy.permissions
-    tenantId: contains(accessPolicy, 'tenantId') ? accessPolicy.tenantId : tenant().tenantId
+    tenantId: accessPolicy.?tenantId ?? tenant().tenantId
   }
 ]
 
@@ -57,10 +57,7 @@ module keyVault 'br/public:avm/res/key-vault/vault:0.5.1' = {
   params: {
     name: keyVaultName
     location: location
-    tags: union(
-      tags ?? {},
-      contains(tagsByResource, 'Microsoft.KeyVault/vaults') ? tagsByResource['Microsoft.KeyVault/vaults'] : {}
-    )
+    tags: union(tags ?? {}, tagsByResource[?'Microsoft.KeyVault/vaults'] ?? {})
     enableVaultForDeployment: true
     enableVaultForTemplateDeployment: true
     enableVaultForDiskEncryption: true
diff --git a/avm/ptn/finops-toolkit/finops-hub/modules/storage.bicep b/avm/ptn/finops-toolkit/finops-hub/modules/storage.bicep
index 7189586b6e..83d7547297 100644
--- a/avm/ptn/finops-toolkit/finops-hub/modules/storage.bicep
+++ b/avm/ptn/finops-toolkit/finops-hub/modules/storage.bicep
@@ -45,12 +45,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.8.3' = {
     name: storageAccountName
     skuName: sku
     kind: 'BlockBlobStorage'
-    tags: union(
-      tags ?? {},
-      contains(tagsByResource, 'Microsoft.Storage/storageAccounts')
-        ? tagsByResource['Microsoft.Storage/storageAccounts']
-        : {}
-    )
+    tags: union(tags ?? {}, tagsByResource[?'Microsoft.Storage/storageAccounts'] ?? {})
     supportsHttpsTrafficOnly: true
     minimumTlsVersion: 'TLS1_2'
     allowBlobPublicAccess: false
@@ -101,12 +96,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.8.3' = {
 // Create managed identity to upload files
 resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
   name: '${storageAccountName}_blobManager'
-  tags: union(
-    tags ?? {},
-    contains(tagsByResource, 'Microsoft.ManagedIdentity/userAssignedIdentities')
-      ? tagsByResource['Microsoft.ManagedIdentity/userAssignedIdentities']
-      : {}
-  )
+  tags: union(tags ?? {}, tagsByResource[?'Microsoft.ManagedIdentity/userAssignedIdentities'] ?? {})
   location: location
 }
 
@@ -116,12 +106,7 @@ module uploadSettings 'br/public:avm/res/resources/deployment-script:0.2.0' = {
     name: 'uploadSettings'
     kind: 'AzurePowerShell'
     location: startsWith(location, 'china') ? 'chinaeast2' : location
-    tags: union(
-      tags ?? {},
-      contains(tagsByResource, 'Microsoft.Resources/deploymentScripts')
-        ? tagsByResource['Microsoft.Resources/deploymentScripts']
-        : {}
-    )
+    tags: union(tags ?? {}, tagsByResource[?'Microsoft.Resources/deploymentScripts'] ?? {})
     managedIdentities: {
       userAssignedResourcesIds: [
         identity.id
diff --git a/avm/res/api-management/service/README.md b/avm/res/api-management/service/README.md
index 001834436f..fa41e81140 100644
--- a/avm/res/api-management/service/README.md
+++ b/avm/res/api-management/service/README.md
@@ -336,6 +336,7 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
         ]
         authority: '<authority>'
         clientId: 'apimClientid'
+        clientLibrary: 'MSAL-2'
         clientSecret: 'apimSlientSecret'
         name: 'aad'
         signinTenant: 'mytenant.onmicrosoft.com'
@@ -578,6 +579,7 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
           ],
           "authority": "<authority>",
           "clientId": "apimClientid",
+          "clientLibrary": "MSAL-2",
           "clientSecret": "apimSlientSecret",
           "name": "aad",
           "signinTenant": "mytenant.onmicrosoft.com"
@@ -892,6 +894,7 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
         ]
         authority: '<authority>'
         clientId: 'apimClientid'
+        clientLibrary: 'MSAL-2'
         clientSecret: '<clientSecret>'
         name: 'aad'
         signinTenant: 'mytenant.onmicrosoft.com'
@@ -1112,6 +1115,7 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
           ],
           "authority": "<authority>",
           "clientId": "apimClientid",
+          "clientLibrary": "MSAL-2",
           "clientSecret": "<clientSecret>",
           "name": "aad",
           "signinTenant": "mytenant.onmicrosoft.com"
diff --git a/avm/res/api-management/service/api/main.bicep b/avm/res/api-management/service/api/main.bicep
index f3cf6a2b3c..6b83aae577 100644
--- a/avm/res/api-management/service/api/main.bicep
+++ b/avm/res/api-management/service/api/main.bicep
@@ -142,7 +142,7 @@ module policy 'policy/main.bicep' = [
     params: {
       apiManagementServiceName: apiManagementServiceName
       apiName: api.name
-      format: contains(policy, 'format') ? policy.format : 'xml'
+      format: policy.?format ?? 'xml'
       value: policy.value
     }
   }
diff --git a/avm/res/api-management/service/api/main.json b/avm/res/api-management/service/api/main.json
index e94c21cc8f..970b83350d 100644
--- a/avm/res/api-management/service/api/main.json
+++ b/avm/res/api-management/service/api/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13121653397859804060"
+      "templateHash": "17160750790361326516"
     },
     "name": "API Management Service APIs",
     "description": "This module deploys an API Management Service API.",
@@ -270,7 +270,9 @@
           "apiName": {
             "value": "[parameters('name')]"
           },
-          "format": "[if(contains(coalesce(parameters('policies'), createArray())[copyIndex()], 'format'), createObject('value', coalesce(parameters('policies'), createArray())[copyIndex()].format), createObject('value', 'xml'))]",
+          "format": {
+            "value": "[coalesce(tryGet(coalesce(parameters('policies'), createArray())[copyIndex()], 'format'), 'xml')]"
+          },
           "value": {
             "value": "[coalesce(parameters('policies'), createArray())[copyIndex()].value]"
           }
diff --git a/avm/res/api-management/service/identity-provider/README.md b/avm/res/api-management/service/identity-provider/README.md
index 0aa8867b84..afd2f02cd6 100644
--- a/avm/res/api-management/service/identity-provider/README.md
+++ b/avm/res/api-management/service/identity-provider/README.md
@@ -36,6 +36,7 @@ This module deploys an API Management Service Identity Provider.
 | :-- | :-- | :-- |
 | [`allowedTenants`](#parameter-allowedtenants) | array | List of Allowed Tenants when configuring Azure Active Directory login. - string. |
 | [`authority`](#parameter-authority) | string | OpenID Connect discovery endpoint hostname for AAD or AAD B2C. |
+| [`clientLibrary`](#parameter-clientlibrary) | string | The client library to be used in the developer portal. Only applies to AAD and AAD B2C Identity Provider. |
 | [`passwordResetPolicyName`](#parameter-passwordresetpolicyname) | string | Password Reset Policy Name. Only applies to AAD B2C Identity Provider. |
 | [`profileEditingPolicyName`](#parameter-profileeditingpolicyname) | string | Profile Editing Policy Name. Only applies to AAD B2C Identity Provider. |
 | [`signInPolicyName`](#parameter-signinpolicyname) | string | Signin Policy Name. Only applies to AAD B2C Identity Provider. |
@@ -89,6 +90,20 @@ OpenID Connect discovery endpoint hostname for AAD or AAD B2C.
 - Type: string
 - Default: `''`
 
+### Parameter: `clientLibrary`
+
+The client library to be used in the developer portal. Only applies to AAD and AAD B2C Identity Provider.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'ADAL'
+    'MSAL-2'
+  ]
+  ```
+
 ### Parameter: `passwordResetPolicyName`
 
 Password Reset Policy Name. Only applies to AAD B2C Identity Provider.
diff --git a/avm/res/api-management/service/identity-provider/main.bicep b/avm/res/api-management/service/identity-provider/main.bicep
index 0c6ec2ebcb..8306fe54c9 100644
--- a/avm/res/api-management/service/identity-provider/main.bicep
+++ b/avm/res/api-management/service/identity-provider/main.bicep
@@ -14,6 +14,13 @@ param authority string = ''
 @description('Conditional. Client ID of the Application in the external Identity Provider. Required if identity provider is used.')
 param clientId string = ''
 
+@description('Optional. The client library to be used in the developer portal. Only applies to AAD and AAD B2C Identity Provider.')
+@allowed([
+  'ADAL'
+  'MSAL-2'
+])
+param clientLibrary string?
+
 @description('Conditional. Client secret of the Application in external Identity Provider, used to authenticate login request. Required if identity provider is used.')
 @secure()
 param clientSecret string = ''
@@ -67,6 +74,7 @@ resource identityProvider 'Microsoft.ApiManagement/service/identityProviders@202
     profileEditingPolicyName: isAadB2C ? profileEditingPolicyName : null
     passwordResetPolicyName: isAadB2C ? passwordResetPolicyName : null
     clientId: clientId
+    clientLibrary: clientLibrary
     clientSecret: clientSecret
   }
 }
diff --git a/avm/res/api-management/service/identity-provider/main.json b/avm/res/api-management/service/identity-provider/main.json
index a6563d4a31..f9e6cbe086 100644
--- a/avm/res/api-management/service/identity-provider/main.json
+++ b/avm/res/api-management/service/identity-provider/main.json
@@ -1,11 +1,12 @@
 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
   "contentVersion": "1.0.0.0",
   "metadata": {
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13129392765749462635"
+      "templateHash": "12757169124799431378"
     },
     "name": "API Management Service Identity Providers",
     "description": "This module deploys an API Management Service Identity Provider.",
@@ -39,6 +40,17 @@
         "description": "Conditional. Client ID of the Application in the external Identity Provider. Required if identity provider is used."
       }
     },
+    "clientLibrary": {
+      "type": "string",
+      "nullable": true,
+      "allowedValues": [
+        "ADAL",
+        "MSAL-2"
+      ],
+      "metadata": {
+        "description": "Optional. The client library to be used in the developer portal. Only applies to AAD and AAD B2C Identity Provider."
+      }
+    },
     "clientSecret": {
       "type": "securestring",
       "defaultValue": "",
@@ -106,8 +118,14 @@
   "variables": {
     "isAadB2C": "[equals(parameters('type'), 'aadB2C')]"
   },
-  "resources": [
-    {
+  "resources": {
+    "service": {
+      "existing": true,
+      "type": "Microsoft.ApiManagement/service",
+      "apiVersion": "2023-05-01-preview",
+      "name": "[parameters('apiManagementServiceName')]"
+    },
+    "identityProvider": {
       "type": "Microsoft.ApiManagement/service/identityProviders",
       "apiVersion": "2022-08-01",
       "name": "[format('{0}/{1}', parameters('apiManagementServiceName'), parameters('name'))]",
@@ -121,10 +139,14 @@
         "profileEditingPolicyName": "[if(variables('isAadB2C'), parameters('profileEditingPolicyName'), null())]",
         "passwordResetPolicyName": "[if(variables('isAadB2C'), parameters('passwordResetPolicyName'), null())]",
         "clientId": "[parameters('clientId')]",
+        "clientLibrary": "[parameters('clientLibrary')]",
         "clientSecret": "[parameters('clientSecret')]"
-      }
+      },
+      "dependsOn": [
+        "service"
+      ]
     }
-  ],
+  },
   "outputs": {
     "resourceId": {
       "type": "string",
diff --git a/avm/res/api-management/service/main.bicep b/avm/res/api-management/service/main.bicep
index f78d4be2a0..2ee1c95c75 100644
--- a/avm/res/api-management/service/main.bicep
+++ b/avm/res/api-management/service/main.bicep
@@ -299,7 +299,7 @@ module service_apiVersionSets 'api-version-set/main.bicep' = [
     params: {
       apiManagementServiceName: service.name
       name: apiVersionSet.name
-      properties: contains(apiVersionSet, 'properties') ? apiVersionSet.properties : {}
+      properties: apiVersionSet.?properties ?? {}
     }
   }
 ]
@@ -311,40 +311,20 @@ module service_authorizationServers 'authorization-server/main.bicep' = [
       apiManagementServiceName: service.name
       name: authorizationServer.name
       authorizationEndpoint: authorizationServer.authorizationEndpoint
-      authorizationMethods: contains(authorizationServer, 'authorizationMethods')
-        ? authorizationServer.authorizationMethods
-        : [
-            'GET'
-          ]
-      bearerTokenSendingMethods: contains(authorizationServer, 'bearerTokenSendingMethods')
-        ? authorizationServer.bearerTokenSendingMethods
-        : [
-            'authorizationHeader'
-          ]
-      clientAuthenticationMethod: contains(authorizationServer, 'clientAuthenticationMethod')
-        ? authorizationServer.clientAuthenticationMethod
-        : [
-            'Basic'
-          ]
+      authorizationMethods: authorizationServer.?authorizationMethods ?? ['GET']
+      bearerTokenSendingMethods: authorizationServer.?bearerTokenSendingMethods ?? ['authorizationHeader']
+      clientAuthenticationMethod: authorizationServer.?clientAuthenticationMethod ?? ['Basic']
       clientId: authorizationServer.clientId
       clientSecret: authorizationServer.clientSecret
-      clientRegistrationEndpoint: contains(authorizationServer, 'clientRegistrationEndpoint')
-        ? authorizationServer.clientRegistrationEndpoint
-        : ''
-      defaultScope: contains(authorizationServer, 'defaultScope') ? authorizationServer.defaultScope : ''
+      clientRegistrationEndpoint: authorizationServer.?clientRegistrationEndpoint ?? ''
+      defaultScope: authorizationServer.?defaultScope ?? ''
       grantTypes: authorizationServer.grantTypes
-      resourceOwnerPassword: contains(authorizationServer, 'resourceOwnerPassword')
-        ? authorizationServer.resourceOwnerPassword
-        : ''
-      resourceOwnerUsername: contains(authorizationServer, 'resourceOwnerUsername')
-        ? authorizationServer.resourceOwnerUsername
-        : ''
-      serverDescription: contains(authorizationServer, 'serverDescription') ? authorizationServer.serverDescription : ''
-      supportState: contains(authorizationServer, 'supportState') ? authorizationServer.supportState : false
-      tokenBodyParameters: contains(authorizationServer, 'tokenBodyParameters')
-        ? authorizationServer.tokenBodyParameters
-        : []
-      tokenEndpoint: contains(authorizationServer, 'tokenEndpoint') ? authorizationServer.tokenEndpoint : ''
+      resourceOwnerPassword: authorizationServer.?resourceOwnerPassword ?? ''
+      resourceOwnerUsername: authorizationServer.?resourceOwnerUsername ?? ''
+      serverDescription: authorizationServer.?serverDescription ?? ''
+      supportState: authorizationServer.?supportState ?? false
+      tokenBodyParameters: authorizationServer.?tokenBodyParameters ?? []
+      tokenEndpoint: authorizationServer.?tokenEndpoint ?? ''
     }
   }
 ]
@@ -413,20 +393,17 @@ module service_identityProviders 'identity-provider/main.bicep' = [
     params: {
       apiManagementServiceName: service.name
       name: identityProvider.name
-      allowedTenants: contains(identityProvider, 'allowedTenants') ? identityProvider.allowedTenants : []
-      authority: contains(identityProvider, 'authority') ? identityProvider.authority : ''
-      clientId: contains(identityProvider, 'clientId') ? identityProvider.clientId : ''
-      clientSecret: contains(identityProvider, 'clientSecret') ? identityProvider.clientSecret : ''
-      passwordResetPolicyName: contains(identityProvider, 'passwordResetPolicyName')
-        ? identityProvider.passwordResetPolicyName
-        : ''
-      profileEditingPolicyName: contains(identityProvider, 'profileEditingPolicyName')
-        ? identityProvider.profileEditingPolicyName
-        : ''
-      signInPolicyName: contains(identityProvider, 'signInPolicyName') ? identityProvider.signInPolicyName : ''
-      signInTenant: contains(identityProvider, 'signInTenant') ? identityProvider.signInTenant : ''
-      signUpPolicyName: contains(identityProvider, 'signUpPolicyName') ? identityProvider.signUpPolicyName : ''
-      type: contains(identityProvider, 'type') ? identityProvider.type : 'aad'
+      allowedTenants: identityProvider.?allowedTenants ?? []
+      authority: identityProvider.?authority ?? ''
+      clientId: identityProvider.?clientId ?? ''
+      clientLibrary: identityProvider.?clientLibrary ?? ''
+      clientSecret: identityProvider.?clientSecret ?? ''
+      passwordResetPolicyName: identityProvider.?passwordResetPolicyName ?? ''
+      profileEditingPolicyName: identityProvider.?profileEditingPolicyName ?? ''
+      signInPolicyName: identityProvider.?signInPolicyName ?? ''
+      signInTenant: identityProvider.?signInTenant ?? ''
+      signUpPolicyName: identityProvider.?signUpPolicyName ?? ''
+      type: identityProvider.?type ?? 'aad'
     }
   }
 ]
@@ -437,11 +414,11 @@ module service_loggers 'loggers/main.bicep' = [
     params: {
       name: logger.name
       apiManagementServiceName: service.name
-      credentials: contains(logger, 'credentials') ? logger.credentials : {}
-      isBuffered: contains(logger, 'isBuffered') ? logger.isBuffered : true
-      loggerDescription: contains(logger, 'loggerDescription') ? logger.loggerDescription : ''
-      loggerType: contains(logger, 'loggerType') ? logger.loggerType : 'azureMonitor'
-      targetResourceId: contains(logger, 'targetResourceId') ? logger.targetResourceId : ''
+      credentials: logger.?credentials ?? {}
+      isBuffered: logger.?isBuffered ?? true
+      loggerDescription: logger.?loggerDescription ?? ''
+      loggerType: logger.?loggerType ?? 'azureMonitor'
+      targetResourceId: logger.?targetResourceId ?? ''
     }
     dependsOn: [
       service_namedValues
@@ -455,11 +432,11 @@ module service_namedValues 'named-value/main.bicep' = [
     params: {
       apiManagementServiceName: service.name
       displayName: namedValue.displayName
-      keyVault: contains(namedValue, 'keyVault') ? namedValue.keyVault : {}
+      keyVault: namedValue.?keyVault ?? {}
       name: namedValue.name
       tags: namedValue.?tags // Note: these are not resource tags
-      secret: contains(namedValue, 'secret') ? namedValue.secret : false
-      value: contains(namedValue, 'value') ? namedValue.value : newGuidValue
+      secret: namedValue.?secret ?? false
+      value: namedValue.?value ?? newGuidValue
     }
   }
 ]
@@ -481,7 +458,7 @@ module service_policies 'policy/main.bicep' = [
     params: {
       apiManagementServiceName: service.name
       value: policy.value
-      format: contains(policy, 'format') ? policy.format : 'xml'
+      format: policy.?format ?? 'xml'
     }
   }
 ]
@@ -491,15 +468,15 @@ module service_products 'product/main.bicep' = [
     name: '${uniqueString(deployment().name, location)}-Apim-Product-${index}'
     params: {
       apiManagementServiceName: service.name
-      apis: contains(product, 'apis') ? product.apis : []
-      approvalRequired: contains(product, 'approvalRequired') ? product.approvalRequired : false
-      groups: contains(product, 'groups') ? product.groups : []
+      apis: product.?apis ?? []
+      approvalRequired: product.?approvalRequired ?? false
+      groups: product.?groups ?? []
       name: product.name
-      description: contains(product, 'description') ? product.description : ''
-      state: contains(product, 'state') ? product.state : 'published'
-      subscriptionRequired: contains(product, 'subscriptionRequired') ? product.subscriptionRequired : false
-      subscriptionsLimit: contains(product, 'subscriptionsLimit') ? product.subscriptionsLimit : 1
-      terms: contains(product, 'terms') ? product.terms : ''
+      description: product.?description ?? ''
+      state: product.?state ?? 'published'
+      subscriptionRequired: product.?subscriptionRequired ?? false
+      subscriptionsLimit: product.?subscriptionsLimit ?? 1
+      terms: product.?terms ?? ''
     }
     dependsOn: [
       service_apis
diff --git a/avm/res/api-management/service/main.json b/avm/res/api-management/service/main.json
index bf4c30828b..fdb9002616 100644
--- a/avm/res/api-management/service/main.json
+++ b/avm/res/api-management/service/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "17512486952547559585"
+      "templateHash": "17385483787660298242"
     },
     "name": "API Management Services",
     "description": "This module deploys an API Management Service. The default deployment is set to use a Premium SKU to align with Microsoft WAF-aligned best practices. In most cases, non-prod deployments should use a lower-tier SKU.",
@@ -792,7 +792,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13121653397859804060"
+              "templateHash": "17160750790361326516"
             },
             "name": "API Management Service APIs",
             "description": "This module deploys an API Management Service API.",
@@ -1056,7 +1056,9 @@
                   "apiName": {
                     "value": "[parameters('name')]"
                   },
-                  "format": "[if(contains(coalesce(parameters('policies'), createArray())[copyIndex()], 'format'), createObject('value', coalesce(parameters('policies'), createArray())[copyIndex()].format), createObject('value', 'xml'))]",
+                  "format": {
+                    "value": "[coalesce(tryGet(coalesce(parameters('policies'), createArray())[copyIndex()], 'format'), 'xml')]"
+                  },
                   "value": {
                     "value": "[coalesce(parameters('policies'), createArray())[copyIndex()].value]"
                   }
@@ -1432,7 +1434,9 @@
           "name": {
             "value": "[parameters('apiVersionSets')[copyIndex()].name]"
           },
-          "properties": "[if(contains(parameters('apiVersionSets')[copyIndex()], 'properties'), createObject('value', parameters('apiVersionSets')[copyIndex()].properties), createObject('value', createObject()))]"
+          "properties": {
+            "value": "[coalesce(tryGet(parameters('apiVersionSets')[copyIndex()], 'properties'), createObject())]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -1529,26 +1533,48 @@
           "authorizationEndpoint": {
             "value": "[variables('authorizationServerList')[copyIndex()].authorizationEndpoint]"
           },
-          "authorizationMethods": "[if(contains(variables('authorizationServerList')[copyIndex()], 'authorizationMethods'), createObject('value', variables('authorizationServerList')[copyIndex()].authorizationMethods), createObject('value', createArray('GET')))]",
-          "bearerTokenSendingMethods": "[if(contains(variables('authorizationServerList')[copyIndex()], 'bearerTokenSendingMethods'), createObject('value', variables('authorizationServerList')[copyIndex()].bearerTokenSendingMethods), createObject('value', createArray('authorizationHeader')))]",
-          "clientAuthenticationMethod": "[if(contains(variables('authorizationServerList')[copyIndex()], 'clientAuthenticationMethod'), createObject('value', variables('authorizationServerList')[copyIndex()].clientAuthenticationMethod), createObject('value', createArray('Basic')))]",
+          "authorizationMethods": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'authorizationMethods'), createArray('GET'))]"
+          },
+          "bearerTokenSendingMethods": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'bearerTokenSendingMethods'), createArray('authorizationHeader'))]"
+          },
+          "clientAuthenticationMethod": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'clientAuthenticationMethod'), createArray('Basic'))]"
+          },
           "clientId": {
             "value": "[variables('authorizationServerList')[copyIndex()].clientId]"
           },
           "clientSecret": {
             "value": "[variables('authorizationServerList')[copyIndex()].clientSecret]"
           },
-          "clientRegistrationEndpoint": "[if(contains(variables('authorizationServerList')[copyIndex()], 'clientRegistrationEndpoint'), createObject('value', variables('authorizationServerList')[copyIndex()].clientRegistrationEndpoint), createObject('value', ''))]",
-          "defaultScope": "[if(contains(variables('authorizationServerList')[copyIndex()], 'defaultScope'), createObject('value', variables('authorizationServerList')[copyIndex()].defaultScope), createObject('value', ''))]",
+          "clientRegistrationEndpoint": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'clientRegistrationEndpoint'), '')]"
+          },
+          "defaultScope": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'defaultScope'), '')]"
+          },
           "grantTypes": {
             "value": "[variables('authorizationServerList')[copyIndex()].grantTypes]"
           },
-          "resourceOwnerPassword": "[if(contains(variables('authorizationServerList')[copyIndex()], 'resourceOwnerPassword'), createObject('value', variables('authorizationServerList')[copyIndex()].resourceOwnerPassword), createObject('value', ''))]",
-          "resourceOwnerUsername": "[if(contains(variables('authorizationServerList')[copyIndex()], 'resourceOwnerUsername'), createObject('value', variables('authorizationServerList')[copyIndex()].resourceOwnerUsername), createObject('value', ''))]",
-          "serverDescription": "[if(contains(variables('authorizationServerList')[copyIndex()], 'serverDescription'), createObject('value', variables('authorizationServerList')[copyIndex()].serverDescription), createObject('value', ''))]",
-          "supportState": "[if(contains(variables('authorizationServerList')[copyIndex()], 'supportState'), createObject('value', variables('authorizationServerList')[copyIndex()].supportState), createObject('value', false()))]",
-          "tokenBodyParameters": "[if(contains(variables('authorizationServerList')[copyIndex()], 'tokenBodyParameters'), createObject('value', variables('authorizationServerList')[copyIndex()].tokenBodyParameters), createObject('value', createArray()))]",
-          "tokenEndpoint": "[if(contains(variables('authorizationServerList')[copyIndex()], 'tokenEndpoint'), createObject('value', variables('authorizationServerList')[copyIndex()].tokenEndpoint), createObject('value', ''))]"
+          "resourceOwnerPassword": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'resourceOwnerPassword'), '')]"
+          },
+          "resourceOwnerUsername": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'resourceOwnerUsername'), '')]"
+          },
+          "serverDescription": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'serverDescription'), '')]"
+          },
+          "supportState": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'supportState'), false())]"
+          },
+          "tokenBodyParameters": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'tokenBodyParameters'), createArray())]"
+          },
+          "tokenEndpoint": {
+            "value": "[coalesce(tryGet(variables('authorizationServerList')[copyIndex()], 'tokenEndpoint'), '')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -2330,25 +2356,49 @@
           "name": {
             "value": "[parameters('identityProviders')[copyIndex()].name]"
           },
-          "allowedTenants": "[if(contains(parameters('identityProviders')[copyIndex()], 'allowedTenants'), createObject('value', parameters('identityProviders')[copyIndex()].allowedTenants), createObject('value', createArray()))]",
-          "authority": "[if(contains(parameters('identityProviders')[copyIndex()], 'authority'), createObject('value', parameters('identityProviders')[copyIndex()].authority), createObject('value', ''))]",
-          "clientId": "[if(contains(parameters('identityProviders')[copyIndex()], 'clientId'), createObject('value', parameters('identityProviders')[copyIndex()].clientId), createObject('value', ''))]",
-          "clientSecret": "[if(contains(parameters('identityProviders')[copyIndex()], 'clientSecret'), createObject('value', parameters('identityProviders')[copyIndex()].clientSecret), createObject('value', ''))]",
-          "passwordResetPolicyName": "[if(contains(parameters('identityProviders')[copyIndex()], 'passwordResetPolicyName'), createObject('value', parameters('identityProviders')[copyIndex()].passwordResetPolicyName), createObject('value', ''))]",
-          "profileEditingPolicyName": "[if(contains(parameters('identityProviders')[copyIndex()], 'profileEditingPolicyName'), createObject('value', parameters('identityProviders')[copyIndex()].profileEditingPolicyName), createObject('value', ''))]",
-          "signInPolicyName": "[if(contains(parameters('identityProviders')[copyIndex()], 'signInPolicyName'), createObject('value', parameters('identityProviders')[copyIndex()].signInPolicyName), createObject('value', ''))]",
-          "signInTenant": "[if(contains(parameters('identityProviders')[copyIndex()], 'signInTenant'), createObject('value', parameters('identityProviders')[copyIndex()].signInTenant), createObject('value', ''))]",
-          "signUpPolicyName": "[if(contains(parameters('identityProviders')[copyIndex()], 'signUpPolicyName'), createObject('value', parameters('identityProviders')[copyIndex()].signUpPolicyName), createObject('value', ''))]",
-          "type": "[if(contains(parameters('identityProviders')[copyIndex()], 'type'), createObject('value', parameters('identityProviders')[copyIndex()].type), createObject('value', 'aad'))]"
+          "allowedTenants": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'allowedTenants'), createArray())]"
+          },
+          "authority": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'authority'), '')]"
+          },
+          "clientId": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'clientId'), '')]"
+          },
+          "clientLibrary": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'clientLibrary'), '')]"
+          },
+          "clientSecret": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'clientSecret'), '')]"
+          },
+          "passwordResetPolicyName": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'passwordResetPolicyName'), '')]"
+          },
+          "profileEditingPolicyName": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'profileEditingPolicyName'), '')]"
+          },
+          "signInPolicyName": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'signInPolicyName'), '')]"
+          },
+          "signInTenant": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'signInTenant'), '')]"
+          },
+          "signUpPolicyName": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'signUpPolicyName'), '')]"
+          },
+          "type": {
+            "value": "[coalesce(tryGet(parameters('identityProviders')[copyIndex()], 'type'), 'aad')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
           "contentVersion": "1.0.0.0",
           "metadata": {
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13129392765749462635"
+              "templateHash": "12757169124799431378"
             },
             "name": "API Management Service Identity Providers",
             "description": "This module deploys an API Management Service Identity Provider.",
@@ -2382,6 +2432,17 @@
                 "description": "Conditional. Client ID of the Application in the external Identity Provider. Required if identity provider is used."
               }
             },
+            "clientLibrary": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "ADAL",
+                "MSAL-2"
+              ],
+              "metadata": {
+                "description": "Optional. The client library to be used in the developer portal. Only applies to AAD and AAD B2C Identity Provider."
+              }
+            },
             "clientSecret": {
               "type": "securestring",
               "defaultValue": "",
@@ -2449,8 +2510,14 @@
           "variables": {
             "isAadB2C": "[equals(parameters('type'), 'aadB2C')]"
           },
-          "resources": [
-            {
+          "resources": {
+            "service": {
+              "existing": true,
+              "type": "Microsoft.ApiManagement/service",
+              "apiVersion": "2023-05-01-preview",
+              "name": "[parameters('apiManagementServiceName')]"
+            },
+            "identityProvider": {
               "type": "Microsoft.ApiManagement/service/identityProviders",
               "apiVersion": "2022-08-01",
               "name": "[format('{0}/{1}', parameters('apiManagementServiceName'), parameters('name'))]",
@@ -2464,10 +2531,14 @@
                 "profileEditingPolicyName": "[if(variables('isAadB2C'), parameters('profileEditingPolicyName'), null())]",
                 "passwordResetPolicyName": "[if(variables('isAadB2C'), parameters('passwordResetPolicyName'), null())]",
                 "clientId": "[parameters('clientId')]",
+                "clientLibrary": "[parameters('clientLibrary')]",
                 "clientSecret": "[parameters('clientSecret')]"
-              }
+              },
+              "dependsOn": [
+                "service"
+              ]
             }
-          ],
+          },
           "outputs": {
             "resourceId": {
               "type": "string",
@@ -2517,11 +2588,21 @@
           "apiManagementServiceName": {
             "value": "[parameters('name')]"
           },
-          "credentials": "[if(contains(parameters('loggers')[copyIndex()], 'credentials'), createObject('value', parameters('loggers')[copyIndex()].credentials), createObject('value', createObject()))]",
-          "isBuffered": "[if(contains(parameters('loggers')[copyIndex()], 'isBuffered'), createObject('value', parameters('loggers')[copyIndex()].isBuffered), createObject('value', true()))]",
-          "loggerDescription": "[if(contains(parameters('loggers')[copyIndex()], 'loggerDescription'), createObject('value', parameters('loggers')[copyIndex()].loggerDescription), createObject('value', ''))]",
-          "loggerType": "[if(contains(parameters('loggers')[copyIndex()], 'loggerType'), createObject('value', parameters('loggers')[copyIndex()].loggerType), createObject('value', 'azureMonitor'))]",
-          "targetResourceId": "[if(contains(parameters('loggers')[copyIndex()], 'targetResourceId'), createObject('value', parameters('loggers')[copyIndex()].targetResourceId), createObject('value', ''))]"
+          "credentials": {
+            "value": "[coalesce(tryGet(parameters('loggers')[copyIndex()], 'credentials'), createObject())]"
+          },
+          "isBuffered": {
+            "value": "[coalesce(tryGet(parameters('loggers')[copyIndex()], 'isBuffered'), true())]"
+          },
+          "loggerDescription": {
+            "value": "[coalesce(tryGet(parameters('loggers')[copyIndex()], 'loggerDescription'), '')]"
+          },
+          "loggerType": {
+            "value": "[coalesce(tryGet(parameters('loggers')[copyIndex()], 'loggerType'), 'azureMonitor')]"
+          },
+          "targetResourceId": {
+            "value": "[coalesce(tryGet(parameters('loggers')[copyIndex()], 'targetResourceId'), '')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -2650,15 +2731,21 @@
           "displayName": {
             "value": "[parameters('namedValues')[copyIndex()].displayName]"
           },
-          "keyVault": "[if(contains(parameters('namedValues')[copyIndex()], 'keyVault'), createObject('value', parameters('namedValues')[copyIndex()].keyVault), createObject('value', createObject()))]",
+          "keyVault": {
+            "value": "[coalesce(tryGet(parameters('namedValues')[copyIndex()], 'keyVault'), createObject())]"
+          },
           "name": {
             "value": "[parameters('namedValues')[copyIndex()].name]"
           },
           "tags": {
             "value": "[tryGet(parameters('namedValues')[copyIndex()], 'tags')]"
           },
-          "secret": "[if(contains(parameters('namedValues')[copyIndex()], 'secret'), createObject('value', parameters('namedValues')[copyIndex()].secret), createObject('value', false()))]",
-          "value": "[if(contains(parameters('namedValues')[copyIndex()], 'value'), createObject('value', parameters('namedValues')[copyIndex()].value), createObject('value', parameters('newGuidValue')))]"
+          "secret": {
+            "value": "[coalesce(tryGet(parameters('namedValues')[copyIndex()], 'secret'), false())]"
+          },
+          "value": {
+            "value": "[coalesce(tryGet(parameters('namedValues')[copyIndex()], 'value'), parameters('newGuidValue'))]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -2897,7 +2984,9 @@
           "value": {
             "value": "[parameters('policies')[copyIndex()].value]"
           },
-          "format": "[if(contains(parameters('policies')[copyIndex()], 'format'), createObject('value', parameters('policies')[copyIndex()].format), createObject('value', 'xml'))]"
+          "format": {
+            "value": "[coalesce(tryGet(parameters('policies')[copyIndex()], 'format'), 'xml')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -3003,17 +3092,33 @@
           "apiManagementServiceName": {
             "value": "[parameters('name')]"
           },
-          "apis": "[if(contains(parameters('products')[copyIndex()], 'apis'), createObject('value', parameters('products')[copyIndex()].apis), createObject('value', createArray()))]",
-          "approvalRequired": "[if(contains(parameters('products')[copyIndex()], 'approvalRequired'), createObject('value', parameters('products')[copyIndex()].approvalRequired), createObject('value', false()))]",
-          "groups": "[if(contains(parameters('products')[copyIndex()], 'groups'), createObject('value', parameters('products')[copyIndex()].groups), createObject('value', createArray()))]",
+          "apis": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'apis'), createArray())]"
+          },
+          "approvalRequired": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'approvalRequired'), false())]"
+          },
+          "groups": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'groups'), createArray())]"
+          },
           "name": {
             "value": "[parameters('products')[copyIndex()].name]"
           },
-          "description": "[if(contains(parameters('products')[copyIndex()], 'description'), createObject('value', parameters('products')[copyIndex()].description), createObject('value', ''))]",
-          "state": "[if(contains(parameters('products')[copyIndex()], 'state'), createObject('value', parameters('products')[copyIndex()].state), createObject('value', 'published'))]",
-          "subscriptionRequired": "[if(contains(parameters('products')[copyIndex()], 'subscriptionRequired'), createObject('value', parameters('products')[copyIndex()].subscriptionRequired), createObject('value', false()))]",
-          "subscriptionsLimit": "[if(contains(parameters('products')[copyIndex()], 'subscriptionsLimit'), createObject('value', parameters('products')[copyIndex()].subscriptionsLimit), createObject('value', 1))]",
-          "terms": "[if(contains(parameters('products')[copyIndex()], 'terms'), createObject('value', parameters('products')[copyIndex()].terms), createObject('value', ''))]"
+          "description": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'description'), '')]"
+          },
+          "state": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'state'), 'published')]"
+          },
+          "subscriptionRequired": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'subscriptionRequired'), false())]"
+          },
+          "subscriptionsLimit": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'subscriptionsLimit'), 1)]"
+          },
+          "terms": {
+            "value": "[coalesce(tryGet(parameters('products')[copyIndex()], 'terms'), '')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
diff --git a/avm/res/api-management/service/tests/e2e/max/main.test.bicep b/avm/res/api-management/service/tests/e2e/max/main.test.bicep
index 39628c62ba..2989495645 100644
--- a/avm/res/api-management/service/tests/e2e/max/main.test.bicep
+++ b/avm/res/api-management/service/tests/e2e/max/main.test.bicep
@@ -171,6 +171,7 @@ module testDeployment '../../../main.bicep' = [
         {
           name: 'aad'
           clientId: 'apimClientid'
+          clientLibrary: 'MSAL-2'
           clientSecret: 'apimSlientSecret'
           authority: split(environment().authentication.loginEndpoint, '/')[2]
           signinTenant: 'mytenant.onmicrosoft.com'
diff --git a/avm/res/api-management/service/tests/e2e/waf-aligned/main.test.bicep b/avm/res/api-management/service/tests/e2e/waf-aligned/main.test.bicep
index 35fac0d255..ccf1f295b4 100644
--- a/avm/res/api-management/service/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/api-management/service/tests/e2e/waf-aligned/main.test.bicep
@@ -161,6 +161,7 @@ module testDeployment '../../../main.bicep' = [
         {
           name: 'aad'
           clientId: 'apimClientid'
+          clientLibrary: 'MSAL-2'
           clientSecret: customSecret
           authority: split(environment().authentication.loginEndpoint, '/')[2]
           signinTenant: 'mytenant.onmicrosoft.com'
diff --git a/avm/res/api-management/service/version.json b/avm/res/api-management/service/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/api-management/service/version.json
+++ b/avm/res/api-management/service/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/app-configuration/configuration-store/README.md b/avm/res/app-configuration/configuration-store/README.md
index 90368d8ca5..06d8a2d62d 100644
--- a/avm/res/app-configuration/configuration-store/README.md
+++ b/avm/res/app-configuration/configuration-store/README.md
@@ -54,7 +54,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
     // Required parameters
     name: 'accmin001'
     // Non-required parameters
-    enablePurgeProtection: '<enablePurgeProtection>'
+    enablePurgeProtection: false
     location: '<location>'
   }
 }
@@ -78,7 +78,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
     },
     // Non-required parameters
     "enablePurgeProtection": {
-      "value": "<enablePurgeProtection>"
+      "value": false
     },
     "location": {
       "value": "<location>"
@@ -113,7 +113,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       userAssignedIdentityResourceId: '<userAssignedIdentityResourceId>'
     }
     disableLocalAuth: '<disableLocalAuth>'
-    enablePurgeProtection: '<enablePurgeProtection>'
+    enablePurgeProtection: false
     keyValues: [
       {
         contentType: 'contentType'
@@ -170,7 +170,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       "value": "<disableLocalAuth>"
     },
     "enablePurgeProtection": {
-      "value": "<enablePurgeProtection>"
+      "value": false
     },
     "keyValues": {
       "value": [
@@ -240,7 +240,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       }
     ]
     disableLocalAuth: '<disableLocalAuth>'
-    enablePurgeProtection: '<enablePurgeProtection>'
+    enablePurgeProtection: false
     keyValues: [
       {
         contentType: 'contentType'
@@ -354,7 +354,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       "value": "<disableLocalAuth>"
     },
     "enablePurgeProtection": {
-      "value": "<enablePurgeProtection>"
+      "value": false
     },
     "keyValues": {
       "value": [
@@ -465,13 +465,17 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
     name: 'accpe001'
     // Non-required parameters
     createMode: 'Default'
-    enablePurgeProtection: '<enablePurgeProtection>'
+    enablePurgeProtection: false
     location: '<location>'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -480,9 +484,13 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -512,7 +520,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       "value": "Default"
     },
     "enablePurgeProtection": {
-      "value": "<enablePurgeProtection>"
+      "value": false
     },
     "location": {
       "value": "<location>"
@@ -520,9 +528,13 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -531,9 +543,13 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -574,7 +590,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       }
     ]
     disableLocalAuth: '<disableLocalAuth>'
-    enablePurgeProtection: '<enablePurgeProtection>'
+    enablePurgeProtection: false
     keyValues: [
       {
         contentType: 'contentType'
@@ -631,7 +647,7 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto
       "value": "<disableLocalAuth>"
     },
     "enablePurgeProtection": {
-      "value": "<enablePurgeProtection>"
+      "value": false
     },
     "keyValues": {
       "value": [
@@ -1024,8 +1040,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1209,19 +1224,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1503,6 +1563,7 @@ Tags of the resource.
 | `endpoint` | string | The endpoint of the app configuration. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the app configuration. |
+| `privateEndpoints` | array | The private endpoints of the app configuration. |
 | `resourceGroupName` | string | The resource group the app configuration store was deployed into. |
 | `resourceId` | string | The resource ID of the app configuration. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1513,7 +1574,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/app-configuration/configuration-store/main.bicep b/avm/res/app-configuration/configuration-store/main.bicep
index d64f33920d..ae336c1257 100644
--- a/avm/res/app-configuration/configuration-store/main.bicep
+++ b/avm/res/app-configuration/configuration-store/main.bicep
@@ -280,7 +280,7 @@ resource configurationStore_roleAssignments 'Microsoft.Authorization/roleAssignm
 ]
 
 @batchSize(1)
-module configurationStore_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module configurationStore_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-configurationStore-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -321,8 +321,7 @@ module configurationStore_privateEndpoints 'br/public:avm/res/network/private-en
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -351,6 +350,17 @@ output location string = configurationStore.location
 @description('The endpoint of the app configuration.')
 output endpoint string = configurationStore.properties.endpoint
 
+@description('The private endpoints of the app configuration.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: configurationStore_privateEndpoints[i].outputs.name
+    resourceId: configurationStore_privateEndpoints[i].outputs.resourceId
+    groupId: configurationStore_privateEndpoints[i].outputs.groupId
+    customDnsConfig: configurationStore_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: configurationStore_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -413,11 +423,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/app-configuration/configuration-store/main.json b/avm/res/app-configuration/configuration-store/main.json
index 07ca7e28c2..969b9aedd2 100644
--- a/avm/res/app-configuration/configuration-store/main.json
+++ b/avm/res/app-configuration/configuration-store/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "3181656887368652471"
+      "templateHash": "11272722521128633240"
     },
     "name": "App Configuration Stores",
     "description": "This module deploys an App Configuration Store.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -1034,11 +1057,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1067,13 +1087,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1325,6 +1366,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1360,18 +1424,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1452,7 +1509,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1531,7 +1588,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1542,28 +1599,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1571,12 +1652,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1590,27 +1674,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1677,6 +1770,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1734,6 +1834,22 @@
         "description": "The endpoint of the app configuration."
       },
       "value": "[reference('configurationStore').endpoint]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the app configuration."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/app-configuration/configuration-store/tests/e2e/pe/main.test.bicep b/avm/res/app-configuration/configuration-store/tests/e2e/pe/main.test.bicep
index b3221b8795..dd8cfe1384 100644
--- a/avm/res/app-configuration/configuration-store/tests/e2e/pe/main.test.bicep
+++ b/avm/res/app-configuration/configuration-store/tests/e2e/pe/main.test.bicep
@@ -53,12 +53,16 @@ module testDeployment '../../../main.bicep' = [
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
       createMode: 'Default'
-      enablePurgeProtection: false //Only for Testing purposes. Waf Aligned is true
+      enablePurgeProtection: false // Only for Testing purposes. Waf Aligned is true
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -68,9 +72,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       softDeleteRetentionInDays: 1
diff --git a/avm/res/app-configuration/configuration-store/version.json b/avm/res/app-configuration/configuration-store/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/app-configuration/configuration-store/version.json
+++ b/avm/res/app-configuration/configuration-store/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/app/container-app/README.md b/avm/res/app/container-app/README.md
index 2923c85dac..9ac975e122 100644
--- a/avm/res/app/container-app/README.md
+++ b/avm/res/app/container-app/README.md
@@ -14,7 +14,7 @@ This module deploys a Container App.
 
 | Resource Type | API Version |
 | :-- | :-- |
-| `Microsoft.App/containerApps` | [2023-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2023-05-01/containerApps) |
+| `Microsoft.App/containerApps` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2024-03-01/containerApps) |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
 
@@ -439,6 +439,13 @@ module containerApp 'br/public:avm/res/app/container-app:<version>' = {
     environmentResourceId: '<environmentResourceId>'
     name: 'acavnet001'
     // Non-required parameters
+    additionalPortMappings: [
+      {
+        exposedPort: 8080
+        external: false
+        targetPort: 8080
+      }
+    ]
     ingressAllowInsecure: false
     ingressExternal: false
     ingressTargetPort: 80
@@ -480,6 +487,15 @@ module containerApp 'br/public:avm/res/app/container-app:<version>' = {
       "value": "acavnet001"
     },
     // Non-required parameters
+    "additionalPortMappings": {
+      "value": [
+        {
+          "exposedPort": 8080,
+          "external": false,
+          "targetPort": 8080
+        }
+      ]
+    },
     "ingressAllowInsecure": {
       "value": false
     },
@@ -665,6 +681,7 @@ module containerApp 'br/public:avm/res/app/container-app:<version>' = {
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
 | [`activeRevisionsMode`](#parameter-activerevisionsmode) | string | Controls how active revisions are handled for the Container app. |
+| [`additionalPortMappings`](#parameter-additionalportmappings) | array | Settings to expose additional ports on container app. |
 | [`clientCertificateMode`](#parameter-clientcertificatemode) | string | Client certificate mode for mTLS. |
 | [`corsPolicy`](#parameter-corspolicy) | object | Object userd to configure CORS policy. |
 | [`customDomains`](#parameter-customdomains) | array | Custom domain bindings for Container App hostnames. |
@@ -672,6 +689,7 @@ module containerApp 'br/public:avm/res/app/container-app:<version>' = {
 | [`disableIngress`](#parameter-disableingress) | bool | Bool to disable all ingress traffic for the container app. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
 | [`exposedPort`](#parameter-exposedport) | int | Exposed Port in containers for TCP traffic from ingress. |
+| [`includeAddOns`](#parameter-includeaddons) | bool | Toggle to include the service configuration. |
 | [`ingressAllowInsecure`](#parameter-ingressallowinsecure) | bool | Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections. |
 | [`ingressExternal`](#parameter-ingressexternal) | bool | Bool indicating if the App exposes an external HTTP endpoint. |
 | [`ingressTargetPort`](#parameter-ingresstargetport) | int | Target Port in containers for traffic from ingress. |
@@ -689,6 +707,8 @@ module containerApp 'br/public:avm/res/app/container-app:<version>' = {
 | [`scaleMinReplicas`](#parameter-scaleminreplicas) | int | Minimum number of container replicas. Defaults to 3 if not set. |
 | [`scaleRules`](#parameter-scalerules) | array | Scaling rules. |
 | [`secrets`](#parameter-secrets) | secureObject | The secrets of the Container App. |
+| [`service`](#parameter-service) | object | Dev ContainerApp service type. |
+| [`serviceBinds`](#parameter-servicebinds) | array | List of container app services bound to the app. |
 | [`stickySessionsAffinity`](#parameter-stickysessionsaffinity) | string | Bool indicating if the Container App should enable session affinity. |
 | [`tags`](#parameter-tags) | object | Tags of the resource. |
 | [`trafficLabel`](#parameter-trafficlabel) | string | Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes. |
@@ -1065,6 +1085,47 @@ Controls how active revisions are handled for the Container app.
   ]
   ```
 
+### Parameter: `additionalPortMappings`
+
+Settings to expose additional ports on container app.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`external`](#parameter-additionalportmappingsexternal) | bool | Specifies whether the app port is accessible outside of the environment. |
+| [`targetPort`](#parameter-additionalportmappingstargetport) | int | Specifies the port the container listens on. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`exposedPort`](#parameter-additionalportmappingsexposedport) | int | Specifies the exposed port for the target port. If not specified, it defaults to target port. |
+
+### Parameter: `additionalPortMappings.external`
+
+Specifies whether the app port is accessible outside of the environment.
+
+- Required: Yes
+- Type: bool
+
+### Parameter: `additionalPortMappings.targetPort`
+
+Specifies the port the container listens on.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `additionalPortMappings.exposedPort`
+
+Specifies the exposed port for the target port. If not specified, it defaults to target port.
+
+- Required: No
+- Type: int
+
 ### Parameter: `clientCertificateMode`
 
 Client certificate mode for mTLS.
@@ -1181,6 +1242,14 @@ Exposed Port in containers for TCP traffic from ingress.
 - Type: int
 - Default: `0`
 
+### Parameter: `includeAddOns`
+
+Toggle to include the service configuration.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
 ### Parameter: `ingressAllowInsecure`
 
 Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections.
@@ -1463,6 +1532,42 @@ The secrets of the Container App.
 - Type: secureObject
 - Default: `{}`
 
+### Parameter: `service`
+
+Dev ContainerApp service type.
+
+- Required: No
+- Type: object
+- Default: `{}`
+
+### Parameter: `serviceBinds`
+
+List of container app services bound to the app.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-servicebindsname) | string | The name of the service. |
+| [`serviceId`](#parameter-servicebindsserviceid) | string | The service ID. |
+
+### Parameter: `serviceBinds.name`
+
+The name of the service.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `serviceBinds.serviceId`
+
+The service ID.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `stickySessionsAffinity`
 
 Bool indicating if the Container App should enable session affinity.
diff --git a/avm/res/app/container-app/main.bicep b/avm/res/app/container-app/main.bicep
index 0ab65f36d0..e1a21c434c 100644
--- a/avm/res/app/container-app/main.bicep
+++ b/avm/res/app/container-app/main.bicep
@@ -41,6 +41,15 @@ param stickySessionsAffinity string = 'none'
 @description('Optional. Ingress transport protocol.')
 param ingressTransport string = 'auto'
 
+@description('Optional. Dev ContainerApp service type.')
+param service object = {}
+
+@description('Optional. Toggle to include the service configuration.')
+param includeAddOns bool = false
+
+@description('Optional. Settings to expose additional ports on container app.')
+param additionalPortMappings ingressPortMapping[]?
+
 @description('Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections.')
 param ingressAllowInsecure bool = true
 
@@ -56,6 +65,9 @@ param scaleMinReplicas int = 3
 @description('Optional. Scaling rules.')
 param scaleRules array = []
 
+@description('Optional. List of container app services bound to the app.')
+param serviceBinds serviceBind[]?
+
 @allowed([
   'Multiple'
   'Single'
@@ -195,7 +207,7 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
   }
 }
 
-resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
+resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
   name: name
   tags: tags
   location: location
@@ -208,6 +220,7 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
       ingress: disableIngress
         ? null
         : {
+            additionalPortMappings: additionalPortMappings
             allowInsecure: ingressTransport != 'tcp' ? ingressAllowInsecure : false
             customDomains: !empty(customDomains) ? customDomains : null
             corsPolicy: corsPolicy != null && ingressTransport != 'tcp'
@@ -240,6 +253,7 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
               : null
             transport: ingressTransport
           }
+          service: (includeAddOns && !empty(service)) ? service : null
       maxInactiveRevisions: maxInactiveRevisions
       registries: !empty(registries) ? registries : null
       secrets: secretList
@@ -253,6 +267,7 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
         minReplicas: scaleMinReplicas
         rules: !empty(scaleRules) ? scaleRules : null
       }
+      serviceBinds: (includeAddOns && !empty(serviceBinds)) ? serviceBinds : null
       volumes: !empty(volumes) ? volumes : null
     }
     workloadProfileName: workloadProfileName
@@ -376,6 +391,25 @@ type container = {
   volumeMounts: volumeMount[]?
 }
 
+type ingressPortMapping = {
+  @description('Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port.')
+  exposedPort: int?
+
+  @description('Required. Specifies whether the app port is accessible outside of the environment.')
+  external: bool
+
+  @description('Required. Specifies the port the container listens on.')
+  targetPort: int
+}
+
+type serviceBind = {
+  @description('Required. The name of the service.')
+  name: string
+
+  @description('Required. The service ID.')
+  serviceId: string
+}
+
 type environmentVar = {
   @description('Required. Environment variable name.')
   name: string
diff --git a/avm/res/app/container-app/main.json b/avm/res/app/container-app/main.json
index 5c921bd6a6..be0ad1bf8b 100644
--- a/avm/res/app/container-app/main.json
+++ b/avm/res/app/container-app/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "9639124785872259212"
+      "templateHash": "7992196126209120702"
     },
     "name": "Container Apps",
     "description": "This module deploys a Container App.",
@@ -208,6 +208,47 @@
         }
       }
     },
+    "ingressPortMapping": {
+      "type": "object",
+      "properties": {
+        "exposedPort": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
+          }
+        },
+        "external": {
+          "type": "bool",
+          "metadata": {
+            "description": "Required. Specifies whether the app port is accessible outside of the environment."
+          }
+        },
+        "targetPort": {
+          "type": "int",
+          "metadata": {
+            "description": "Required. Specifies the port the container listens on."
+          }
+        }
+      }
+    },
+    "serviceBind": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name of the service."
+          }
+        },
+        "serviceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The service ID."
+          }
+        }
+      }
+    },
     "environmentVar": {
       "type": "object",
       "properties": {
@@ -553,6 +594,30 @@
         "description": "Optional. Ingress transport protocol."
       }
     },
+    "service": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. Dev ContainerApp service type."
+      }
+    },
+    "includeAddOns": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Toggle to include the service configuration."
+      }
+    },
+    "additionalPortMappings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/ingressPortMapping"
+      },
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Settings to expose additional ports on container app."
+      }
+    },
     "ingressAllowInsecure": {
       "type": "bool",
       "defaultValue": true,
@@ -588,6 +653,16 @@
         "description": "Optional. Scaling rules."
       }
     },
+    "serviceBinds": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/serviceBind"
+      },
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. List of container app services bound to the app."
+      }
+    },
     "activeRevisionsMode": {
       "type": "string",
       "defaultValue": "Single",
@@ -795,7 +870,7 @@
     },
     "containerApp": {
       "type": "Microsoft.App/containerApps",
-      "apiVersion": "2023-05-01",
+      "apiVersion": "2024-03-01",
       "name": "[parameters('name')]",
       "tags": "[parameters('tags')]",
       "location": "[parameters('location')]",
@@ -805,7 +880,8 @@
         "configuration": {
           "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
           "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
-          "ingress": "[if(parameters('disableIngress'), null(), createObject('allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
+          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
+          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
           "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
           "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
           "secrets": "[variables('secretList')]"
@@ -819,6 +895,7 @@
             "minReplicas": "[parameters('scaleMinReplicas')]",
             "rules": "[if(not(empty(parameters('scaleRules'))), parameters('scaleRules'), null())]"
           },
+          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
           "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
         },
         "workloadProfileName": "[parameters('workloadProfileName')]"
@@ -895,14 +972,14 @@
       "metadata": {
         "description": "The principal ID of the system assigned identity."
       },
-      "value": "[coalesce(tryGet(tryGet(reference('containerApp', '2023-05-01', 'full'), 'identity'), 'principalId'), '')]"
+      "value": "[coalesce(tryGet(tryGet(reference('containerApp', '2024-03-01', 'full'), 'identity'), 'principalId'), '')]"
     },
     "location": {
       "type": "string",
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('containerApp', '2023-05-01', 'full').location]"
+      "value": "[reference('containerApp', '2024-03-01', 'full').location]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/app/container-app/tests/e2e/vnet/main.test.bicep b/avm/res/app/container-app/tests/e2e/vnet/main.test.bicep
index 5a2e4c92e4..3c34893f8c 100644
--- a/avm/res/app/container-app/tests/e2e/vnet/main.test.bicep
+++ b/avm/res/app/container-app/tests/e2e/vnet/main.test.bicep
@@ -57,6 +57,14 @@ module testDeployment '../../../main.bicep' = [
       ingressTransport: 'tcp'
       ingressAllowInsecure: false
       ingressTargetPort: 80
+      additionalPortMappings: [
+        {
+          external: false
+          targetPort: 8080
+          exposedPort: 8080
+        }
+      ]
+
       containers: [
         {
           name: 'simple-hello-world-container'
diff --git a/avm/res/app/container-app/version.json b/avm/res/app/container-app/version.json
index 9a9a06e897..d96f771b50 100644
--- a/avm/res/app/container-app/version.json
+++ b/avm/res/app/container-app/version.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.8",
+  "version": "0.10",
   "pathFilters": [
     "./main.json"
   ]
-}
\ No newline at end of file
+}
diff --git a/avm/res/app/managed-environment/README.md b/avm/res/app/managed-environment/README.md
index f8d2bc7122..66e8fe2364 100644
--- a/avm/res/app/managed-environment/README.md
+++ b/avm/res/app/managed-environment/README.md
@@ -14,8 +14,8 @@ This module deploys an App Managed Environment (also known as a Container App En
 
 | Resource Type | API Version |
 | :-- | :-- |
-| `Microsoft.App/managedEnvironments` | [2023-11-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2023-11-02-preview/managedEnvironments) |
-| `Microsoft.App/managedEnvironments/storages` | [2023-11-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2023-11-02-preview/managedEnvironments/storages) |
+| `Microsoft.App/managedEnvironments` | [2024-02-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2024-02-02-preview/managedEnvironments) |
+| `Microsoft.App/managedEnvironments/storages` | [2024-02-02-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.App/2024-02-02-preview/managedEnvironments/storages) |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
 
@@ -142,6 +142,7 @@ module managedEnvironment 'br/public:avm/res/app/managed-environment:<version>'
     logAnalyticsWorkspaceResourceId: '<logAnalyticsWorkspaceResourceId>'
     name: 'amemax001'
     // Non-required parameters
+    appInsightsConnectionString: '<appInsightsConnectionString>'
     dockerBridgeCidr: '172.16.0.1/28'
     infrastructureResourceGroupName: '<infrastructureResourceGroupName>'
     infrastructureSubnetId: '<infrastructureSubnetId>'
@@ -157,6 +158,19 @@ module managedEnvironment 'br/public:avm/res/app/managed-environment:<version>'
         '<managedIdentityResourceId>'
       ]
     }
+    openTelemetryConfiguration: {
+      logsConfiguration: {
+        destinations: [
+          'appInsights'
+        ]
+      }
+      tracesConfiguration: {
+        destinations: [
+          'appInsights'
+        ]
+      }
+    }
+    peerTrafficEncryption: true
     platformReservedCidr: '172.17.17.0/24'
     platformReservedDnsIP: '172.17.17.17'
     roleAssignments: [
@@ -228,6 +242,9 @@ module managedEnvironment 'br/public:avm/res/app/managed-environment:<version>'
       "value": "amemax001"
     },
     // Non-required parameters
+    "appInsightsConnectionString": {
+      "value": "<appInsightsConnectionString>"
+    },
     "dockerBridgeCidr": {
       "value": "172.16.0.1/28"
     },
@@ -257,6 +274,23 @@ module managedEnvironment 'br/public:avm/res/app/managed-environment:<version>'
         ]
       }
     },
+    "openTelemetryConfiguration": {
+      "value": {
+        "logsConfiguration": {
+          "destinations": [
+            "appInsights"
+          ]
+        },
+        "tracesConfiguration": {
+          "destinations": [
+            "appInsights"
+          ]
+        }
+      }
+    },
+    "peerTrafficEncryption": {
+      "value": true
+    },
     "platformReservedCidr": {
       "value": "172.17.17.0/24"
     },
@@ -498,6 +532,7 @@ module managedEnvironment 'br/public:avm/res/app/managed-environment:<version>'
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
+| [`appInsightsConnectionString`](#parameter-appinsightsconnectionstring) | securestring | Application Insights connection string. |
 | [`certificatePassword`](#parameter-certificatepassword) | securestring | Password of the certificate used by the custom domain. |
 | [`certificateValue`](#parameter-certificatevalue) | securestring | Certificate to use for the custom domain. PFX or PEM. |
 | [`daprAIConnectionString`](#parameter-dapraiconnectionstring) | securestring | Application Insights connection string used by Dapr to export Service to Service communication telemetry. |
@@ -508,6 +543,8 @@ module managedEnvironment 'br/public:avm/res/app/managed-environment:<version>'
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`logsDestination`](#parameter-logsdestination) | string | Logs destination. |
 | [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. |
+| [`openTelemetryConfiguration`](#parameter-opentelemetryconfiguration) | object | Open Telemetry configuration. |
+| [`peerTrafficEncryption`](#parameter-peertrafficencryption) | bool | Whether or not to encrypt peer traffic. |
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
 | [`storages`](#parameter-storages) | array | The list of storages to mount on the environment. |
 | [`tags`](#parameter-tags) | object | Tags of the resource. |
@@ -583,6 +620,14 @@ Workload profiles configured for the Managed Environment. Required if zoneRedund
 - Type: array
 - Default: `[]`
 
+### Parameter: `appInsightsConnectionString`
+
+Application Insights connection string.
+
+- Required: No
+- Type: securestring
+- Default: `''`
+
 ### Parameter: `certificatePassword`
 
 Password of the certificate used by the custom domain.
@@ -711,6 +756,22 @@ The resource ID(s) to assign to the resource.
 - Required: No
 - Type: array
 
+### Parameter: `openTelemetryConfiguration`
+
+Open Telemetry configuration.
+
+- Required: No
+- Type: object
+- Default: `{}`
+
+### Parameter: `peerTrafficEncryption`
+
+Whether or not to encrypt peer traffic.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
 ### Parameter: `roleAssignments`
 
 Array of role assignments to create.
diff --git a/avm/res/app/managed-environment/main.bicep b/avm/res/app/managed-environment/main.bicep
index 51dfa4cf90..07c6dc33af 100644
--- a/avm/res/app/managed-environment/main.bicep
+++ b/avm/res/app/managed-environment/main.bicep
@@ -26,6 +26,10 @@ param logsDestination string = 'log-analytics'
 @description('Optional. Enable/Disable usage telemetry for module.')
 param enableTelemetry bool = true
 
+@description('Optional. Application Insights connection string.')
+@secure()
+param appInsightsConnectionString string = ''
+
 @description('Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry.')
 @secure()
 param daprAIConnectionString string = ''
@@ -49,6 +53,9 @@ param platformReservedCidr string = ''
 @description('Conditional. An IP address from the IP range defined by "platformReservedCidr" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant.')
 param platformReservedDnsIP string = ''
 
+@description('Optional. Whether or not to encrypt peer traffic.')
+param peerTrafficEncryption bool = true
+
 @description('Optional. Whether or not this Managed Environment is zone-redundant.')
 param zoneRedundant bool = true
 
@@ -66,6 +73,9 @@ param dnsSuffix string = ''
 @description('Optional. The lock settings of the service.')
 param lock lockType
 
+@description('Optional. Open Telemetry configuration.')
+param openTelemetryConfiguration object = {}
+
 @description('Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant.')
 param workloadProfiles array = []
 
@@ -134,17 +144,20 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
   }
 }
 
-resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = if (!empty(logAnalyticsWorkspaceResourceId)) {
+resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' existing = if (!empty(logAnalyticsWorkspaceResourceId)) {
   name: last(split(logAnalyticsWorkspaceResourceId, '/'))!
   scope: resourceGroup(split(logAnalyticsWorkspaceResourceId, '/')[2], split(logAnalyticsWorkspaceResourceId, '/')[4])
 }
 
-resource managedEnvironment 'Microsoft.App/managedEnvironments@2023-11-02-preview' = {
+resource managedEnvironment 'Microsoft.App/managedEnvironments@2024-02-02-preview' = {
   name: name
   location: location
   tags: tags
   identity: identity
   properties: {
+    appInsightsConfiguration: {
+      connectionString: appInsightsConnectionString
+    }
     appLogsConfiguration: {
       destination: logsDestination
       logAnalyticsConfiguration: {
@@ -159,6 +172,12 @@ resource managedEnvironment 'Microsoft.App/managedEnvironments@2023-11-02-previe
       certificateValue: !empty(certificateValue) ? certificateValue : null
       dnsSuffix: dnsSuffix
     }
+    openTelemetryConfiguration: !empty(openTelemetryConfiguration) ? openTelemetryConfiguration : null
+    peerTrafficConfiguration: {
+      encryption: {
+        enabled: peerTrafficEncryption
+      }
+    }
     vnetConfiguration: {
       internal: internal
       infrastructureSubnetId: !empty(infrastructureSubnetId) ? infrastructureSubnetId : null
diff --git a/avm/res/app/managed-environment/main.json b/avm/res/app/managed-environment/main.json
index f410b0893a..ed0df72869 100644
--- a/avm/res/app/managed-environment/main.json
+++ b/avm/res/app/managed-environment/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "364014764379639426"
+      "templateHash": "13961196804563097956"
     },
     "name": "App ManagedEnvironments",
     "description": "This module deploys an App Managed Environment (also known as a Container App Environment).",
@@ -229,6 +229,13 @@
         "description": "Optional. Enable/Disable usage telemetry for module."
       }
     },
+    "appInsightsConnectionString": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Application Insights connection string."
+      }
+    },
     "daprAIConnectionString": {
       "type": "securestring",
       "defaultValue": "",
@@ -278,6 +285,13 @@
         "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
       }
     },
+    "peerTrafficEncryption": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Whether or not to encrypt peer traffic."
+      }
+    },
     "zoneRedundant": {
       "type": "bool",
       "defaultValue": true,
@@ -312,6 +326,13 @@
         "description": "Optional. The lock settings of the service."
       }
     },
+    "openTelemetryConfiguration": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. Open Telemetry configuration."
+      }
+    },
     "workloadProfiles": {
       "type": "array",
       "defaultValue": [],
@@ -358,7 +379,7 @@
         "count": "[length(coalesce(parameters('storages'), createArray()))]"
       },
       "type": "Microsoft.App/managedEnvironments/storages",
-      "apiVersion": "2023-11-02-preview",
+      "apiVersion": "2024-02-02-preview",
       "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
       "properties": {
         "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
@@ -392,24 +413,27 @@
       "condition": "[not(empty(parameters('logAnalyticsWorkspaceResourceId')))]",
       "existing": true,
       "type": "Microsoft.OperationalInsights/workspaces",
-      "apiVersion": "2021-06-01",
+      "apiVersion": "2023-09-01",
       "subscriptionId": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2]]",
       "resourceGroup": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]]",
       "name": "[last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))]"
     },
     "managedEnvironment": {
       "type": "Microsoft.App/managedEnvironments",
-      "apiVersion": "2023-11-02-preview",
+      "apiVersion": "2024-02-02-preview",
       "name": "[parameters('name')]",
       "location": "[parameters('location')]",
       "tags": "[parameters('tags')]",
       "identity": "[variables('identity')]",
       "properties": {
+        "appInsightsConfiguration": {
+          "connectionString": "[parameters('appInsightsConnectionString')]"
+        },
         "appLogsConfiguration": {
           "destination": "[parameters('logsDestination')]",
           "logAnalyticsConfiguration": {
             "customerId": "[reference('logAnalyticsWorkspace').customerId]",
-            "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))), '2021-06-01').primarySharedKey]"
+            "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))), '2023-09-01').primarySharedKey]"
           }
         },
         "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
@@ -419,6 +443,12 @@
           "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
           "dnsSuffix": "[parameters('dnsSuffix')]"
         },
+        "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
+        "peerTrafficConfiguration": {
+          "encryption": {
+            "enabled": "[parameters('peerTrafficEncryption')]"
+          }
+        },
         "vnetConfiguration": {
           "internal": "[parameters('internal')]",
           "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('infrastructureSubnetId'), null())]",
@@ -484,7 +514,7 @@
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('managedEnvironment', '2023-11-02-preview', 'full').location]"
+      "value": "[reference('managedEnvironment', '2024-02-02-preview', 'full').location]"
     },
     "name": {
       "type": "string",
@@ -505,7 +535,7 @@
       "metadata": {
         "description": "The principal ID of the system assigned identity."
       },
-      "value": "[coalesce(tryGet(tryGet(reference('managedEnvironment', '2023-11-02-preview', 'full'), 'identity'), 'principalId'), '')]"
+      "value": "[coalesce(tryGet(tryGet(reference('managedEnvironment', '2024-02-02-preview', 'full'), 'identity'), 'principalId'), '')]"
     },
     "defaultDomain": {
       "type": "string",
diff --git a/avm/res/app/managed-environment/tests/e2e/max/dependencies.bicep b/avm/res/app/managed-environment/tests/e2e/max/dependencies.bicep
index ebfde7dbd0..6c836f75d6 100644
--- a/avm/res/app/managed-environment/tests/e2e/max/dependencies.bicep
+++ b/avm/res/app/managed-environment/tests/e2e/max/dependencies.bicep
@@ -4,6 +4,9 @@ param location string = resourceGroup().location
 @description('Required. The name of the Log Analytics Workspace to create.')
 param logAnalyticsWorkspaceName string
 
+@description('Required. The name of the Application Insights Component to create.')
+param appInsightsComponentName string
+
 @description('Required. The name of the Virtual Network to create.')
 param virtualNetworkName string
 
@@ -29,6 +32,16 @@ resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10
   })
 }
 
+resource appInsightsComponent 'Microsoft.Insights/components@2020-02-02' = {
+  name: appInsightsComponentName
+  location: location
+  kind: 'web'
+  properties: {
+    Application_Type: 'web'
+    WorkspaceResourceId: logAnalyticsWorkspace.id
+  }
+}
+
 resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
   name: virtualNetworkName
   location: location
@@ -42,7 +55,7 @@ resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
       {
         name: 'defaultSubnet'
         properties: {
-          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+          addressPrefix: cidrSubnet(addressPrefix, 23, 0)
           delegations: [
             {
               name: 'Microsoft.App.environments'
@@ -121,5 +134,8 @@ output managedIdentityPrincipalId string = managedIdentity.properties.principalI
 @description('The resource ID of the created Managed Identity.')
 output managedIdentityResourceId string = managedIdentity.id
 
+@description('The Connection String of the created Application Insights Component.')
+output appInsightsConnectionString string = appInsightsComponent.properties.ConnectionString
+
 @description('The name of the created Storage Account.')
 output storageAccountName string = storageAccount.name
diff --git a/avm/res/app/managed-environment/tests/e2e/max/main.test.bicep b/avm/res/app/managed-environment/tests/e2e/max/main.test.bicep
index f24d7e6fb8..582c1734c7 100644
--- a/avm/res/app/managed-environment/tests/e2e/max/main.test.bicep
+++ b/avm/res/app/managed-environment/tests/e2e/max/main.test.bicep
@@ -38,6 +38,7 @@ module nestedDependencies 'dependencies.bicep' = {
     virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
     location: resourceLocation
     managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    appInsightsComponentName: 'dep-${namePrefix}-appinsights-${serviceShort}'
     storageAccountName: 'dep${namePrefix}sa${serviceShort}'
   }
 }
@@ -55,6 +56,7 @@ module testDeployment '../../../main.bicep' = [
       name: '${namePrefix}${serviceShort}001'
       logAnalyticsWorkspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
       location: resourceLocation
+      appInsightsConnectionString: nestedDependencies.outputs.appInsightsConnectionString
       workloadProfiles: [
         {
           workloadProfileType: 'D4'
@@ -65,6 +67,7 @@ module testDeployment '../../../main.bicep' = [
       ]
       internal: true
       dockerBridgeCidr: '172.16.0.1/28'
+      peerTrafficEncryption: true
       platformReservedCidr: '172.17.17.0/24'
       platformReservedDnsIP: '172.17.17.17'
       infrastructureSubnetId: nestedDependencies.outputs.subnetResourceId
@@ -75,6 +78,14 @@ module testDeployment '../../../main.bicep' = [
           nestedDependencies.outputs.managedIdentityResourceId
         ]
       }
+      openTelemetryConfiguration: {
+        tracesConfiguration: {
+          destinations: ['appInsights']
+        }
+        logsConfiguration: {
+          destinations: ['appInsights']
+        }
+      }
       roleAssignments: [
         {
           name: '43fc5250-f111-472b-8722-f1cb4a0e754b'
diff --git a/avm/res/app/managed-environment/version.json b/avm/res/app/managed-environment/version.json
index e42c3d9e5f..35040975ae 100644
--- a/avm/res/app/managed-environment/version.json
+++ b/avm/res/app/managed-environment/version.json
@@ -1,7 +1,7 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.6",
+    "version": "0.7",
     "pathFilters": [
         "./main.json"
     ]
-}
\ No newline at end of file
+}
diff --git a/avm/res/automation/automation-account/README.md b/avm/res/automation/automation-account/README.md
index c00fd12b9d..8aa19e6b65 100644
--- a/avm/res/automation/automation-account/README.md
+++ b/avm/res/automation/automation-account/README.md
@@ -236,9 +236,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
     ]
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'Webhook'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -248,9 +252,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'Webhook'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -260,9 +268,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'DSCAndHybridWorker'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -499,9 +511,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "Webhook",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -511,9 +527,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "Webhook",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -523,9 +543,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "DSCAndHybridWorker",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -743,9 +767,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
     ]
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'Webhook'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -755,9 +783,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'DSCAndHybridWorker'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -959,9 +991,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "Webhook",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -971,9 +1007,13 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "DSCAndHybridWorker",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -1544,8 +1584,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1583,19 +1622,19 @@ Custom DNS configurations.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`fqdn`](#parameter-privateendpointscustomdnsconfigsfqdn) | string | Fqdn that resolves to private endpoint ip address. |
-| [`ipAddresses`](#parameter-privateendpointscustomdnsconfigsipaddresses) | array | A list of private ip addresses of the private endpoint. |
+| [`fqdn`](#parameter-privateendpointscustomdnsconfigsfqdn) | string | Fqdn that resolves to private endpoint IP address. |
+| [`ipAddresses`](#parameter-privateendpointscustomdnsconfigsipaddresses) | array | A list of private IP addresses of the private endpoint. |
 
 ### Parameter: `privateEndpoints.customDnsConfigs.fqdn`
 
-Fqdn that resolves to private endpoint ip address.
+Fqdn that resolves to private endpoint IP address.
 
 - Required: No
 - Type: string
 
 ### Parameter: `privateEndpoints.customDnsConfigs.ipAddresses`
 
-A list of private ip addresses of the private endpoint.
+A list of private IP addresses of the private endpoint.
 
 - Required: Yes
 - Type: array
@@ -1648,7 +1687,7 @@ Properties of private endpoint IP configurations.
 | :-- | :-- | :-- |
 | [`groupId`](#parameter-privateendpointsipconfigurationspropertiesgroupid) | string | The ID of a group obtained from the remote resource that this private endpoint should connect to. |
 | [`memberName`](#parameter-privateendpointsipconfigurationspropertiesmembername) | string | The member name of a group obtained from the remote resource that this private endpoint should connect to. |
-| [`privateIPAddress`](#parameter-privateendpointsipconfigurationspropertiesprivateipaddress) | string | A private ip address obtained from the private endpoint's subnet. |
+| [`privateIPAddress`](#parameter-privateendpointsipconfigurationspropertiesprivateipaddress) | string | A private IP address obtained from the private endpoint's subnet. |
 
 ### Parameter: `privateEndpoints.ipConfigurations.properties.groupId`
 
@@ -1666,7 +1705,7 @@ The member name of a group obtained from the remote resource that this private e
 
 ### Parameter: `privateEndpoints.ipConfigurations.properties.privateIPAddress`
 
-A private ip address obtained from the private endpoint's subnet.
+A private IP address obtained from the private endpoint's subnet.
 
 - Required: Yes
 - Type: string
@@ -1735,19 +1774,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -2040,6 +2124,7 @@ List of variables to be created in the automation account.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed automation account. |
+| `privateEndpoints` | array | The private endpoints of the automation account. |
 | `resourceGroupName` | string | The resource group of the deployed automation account. |
 | `resourceId` | string | The resource ID of the deployed automation account. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -2050,7 +2135,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 | `br/public:avm/res/operations-management/solution:0.1.0` | Remote reference |
 
 ## Data Collection
diff --git a/avm/res/automation/automation-account/main.bicep b/avm/res/automation/automation-account/main.bicep
index 76344fa8a6..d50ac1b2c2 100644
--- a/avm/res/automation/automation-account/main.bicep
+++ b/avm/res/automation/automation-account/main.bicep
@@ -464,7 +464,7 @@ resource automationAccount_diagnosticSettings 'Microsoft.Insights/diagnosticSett
   }
 ]
 
-module automationAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module automationAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-automationAccount-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -505,8 +505,7 @@ module automationAccount_privateEndpoints 'br/public:avm/res/network/private-end
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -552,6 +551,17 @@ output systemAssignedMIPrincipalId string = automationAccount.?identity.?princip
 @description('The location the resource was deployed into.')
 output location string = automationAccount.location
 
+@description('The private endpoints of the automation account.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: automationAccount_privateEndpoints[i].outputs.name
+    resourceId: automationAccount_privateEndpoints[i].outputs.resourceId
+    groupId: automationAccount_privateEndpoints[i].outputs.groupId
+    customDnsConfig: automationAccount_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: automationAccount_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -614,11 +624,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
@@ -629,10 +648,10 @@ type privateEndpointType = {
 
   @description('Optional. Custom DNS configurations.')
   customDnsConfigs: {
-    @description('Required. Fqdn that resolves to private endpoint ip address.')
+    @description('Required. Fqdn that resolves to private endpoint IP address.')
     fqdn: string?
 
-    @description('Required. A list of private ip addresses of the private endpoint.')
+    @description('Required. A list of private IP addresses of the private endpoint.')
     ipAddresses: string[]
   }[]?
 
@@ -649,7 +668,7 @@ type privateEndpointType = {
       @description('Required. The member name of a group obtained from the remote resource that this private endpoint should connect to.')
       memberName: string
 
-      @description('Required. A private ip address obtained from the private endpoint\'s subnet.')
+      @description('Required. A private IP address obtained from the private endpoint\'s subnet.')
       privateIPAddress: string
     }
   }[]?
diff --git a/avm/res/automation/automation-account/main.json b/avm/res/automation/automation-account/main.json
index 926cb09d4c..5de3a4f57b 100644
--- a/avm/res/automation/automation-account/main.json
+++ b/avm/res/automation/automation-account/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "17428961598705907466"
+      "templateHash": "7361377079098323612"
     },
     "name": "Automation Accounts",
     "description": "This module deploys an Azure Automation Account.",
@@ -172,21 +172,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -213,7 +236,7 @@
                   "type": "string",
                   "nullable": true,
                   "metadata": {
-                    "description": "Required. Fqdn that resolves to private endpoint ip address."
+                    "description": "Required. Fqdn that resolves to private endpoint IP address."
                   }
                 },
                 "ipAddresses": {
@@ -222,7 +245,7 @@
                     "type": "string"
                   },
                   "metadata": {
-                    "description": "Required. A list of private ip addresses of the private endpoint."
+                    "description": "Required. A list of private IP addresses of the private endpoint."
                   }
                 }
               }
@@ -261,7 +284,7 @@
                     "privateIPAddress": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. A private ip address obtained from the private endpoint's subnet."
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
                       }
                     }
                   },
@@ -2557,11 +2580,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -2590,13 +2610,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -2848,6 +2889,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2883,18 +2947,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2975,7 +3032,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -3054,7 +3111,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -3065,28 +3122,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -3094,12 +3175,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -3113,27 +3197,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -3200,6 +3293,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -3250,6 +3350,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('automationAccount', '2022-08-08', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the automation account."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('automationAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('automationAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('automationAccount_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('automationAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('automationAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/automation/automation-account/tests/e2e/max/main.test.bicep b/avm/res/automation/automation-account/tests/e2e/max/main.test.bicep
index 55e3f986a4..a3dfb495d2 100644
--- a/avm/res/automation/automation-account/tests/e2e/max/main.test.bicep
+++ b/avm/res/automation/automation-account/tests/e2e/max/main.test.bicep
@@ -116,9 +116,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'Webhook'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           tags: {
@@ -128,9 +132,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'Webhook'
           subnetResourceId: nestedDependencies.outputs.customSubnet2ResourceId
           tags: {
@@ -140,9 +148,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'DSCAndHybridWorker'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           tags: {
diff --git a/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep b/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep
index d6182ea498..355d2a8e53 100644
--- a/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep
@@ -103,9 +103,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'Webhook'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
@@ -115,9 +119,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'DSCAndHybridWorker'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/automation/automation-account/version.json b/avm/res/automation/automation-account/version.json
index e42c3d9e5f..7e1d3f4157 100644
--- a/avm/res/automation/automation-account/version.json
+++ b/avm/res/automation/automation-account/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.6",
+    "version": "0.7",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/batch/batch-account/README.md b/avm/res/batch/batch-account/README.md
index 48cf104976..7b725694d8 100644
--- a/avm/res/batch/batch-account/README.md
+++ b/avm/res/batch/batch-account/README.md
@@ -245,9 +245,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
             }
           }
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             name: '9afa4fb3-2157-40db-aebb-039ce73c50ca'
@@ -275,9 +279,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'batchAccount'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -287,9 +295,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'nodeManagement'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -413,9 +425,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
               }
             }
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "name": "9afa4fb3-2157-40db-aebb-039ce73c50ca",
@@ -443,9 +459,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "batchAccount",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -455,9 +475,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "nodeManagement",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -545,9 +569,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
     poolAllocationMode: 'BatchService'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'batchAccount'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -613,9 +641,13 @@ module batchAccount 'br/public:avm/res/batch/batch-account:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "batchAccount",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -1106,8 +1138,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1297,19 +1328,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1577,6 +1653,7 @@ Tags of the resource.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the batch account. |
+| `privateEndpoints` | array | The private endpoints of the batch account. |
 | `resourceGroupName` | string | The resource group the batch account was deployed into. |
 | `resourceId` | string | The resource ID of the batch account. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1587,7 +1664,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/batch/batch-account/main.bicep b/avm/res/batch/batch-account/main.bicep
index 1def5dab9e..1e63676d03 100644
--- a/avm/res/batch/batch-account/main.bicep
+++ b/avm/res/batch/batch-account/main.bicep
@@ -261,7 +261,7 @@ resource batchAccount_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@
   }
 ]
 
-module batchAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module batchAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-batchAccount-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -302,8 +302,7 @@ module batchAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -345,6 +344,17 @@ output location string = batchAccount.location
 @description('The principal ID of the system assigned identity.')
 output systemAssignedMIPrincipalId string = batchAccount.?identity.?principalId ?? ''
 
+@description('The private endpoints of the batch account.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: batchAccount_privateEndpoints[i].outputs.name
+    resourceId: batchAccount_privateEndpoints[i].outputs.resourceId
+    groupId: batchAccount_privateEndpoints[i].outputs.groupId
+    customDnsConfig: batchAccount_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: batchAccount_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // ================ //
 // Definitions      //
 // ================ //
@@ -435,11 +445,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/batch/batch-account/main.json b/avm/res/batch/batch-account/main.json
index 4271760f4f..9a446638ad 100644
--- a/avm/res/batch/batch-account/main.json
+++ b/avm/res/batch/batch-account/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "18266444641847320350"
+      "templateHash": "14365584147698866466"
     },
     "name": "Batch Accounts",
     "description": "This module deploys a Batch Account.",
@@ -244,21 +244,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -877,11 +900,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -910,13 +930,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1168,6 +1209,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1203,18 +1267,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1295,7 +1352,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1374,7 +1431,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1385,28 +1442,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1414,12 +1495,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1433,27 +1517,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1520,6 +1613,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1570,6 +1670,22 @@
         "description": "The principal ID of the system assigned identity."
       },
       "value": "[coalesce(tryGet(tryGet(reference('batchAccount', '2022-06-01', 'full'), 'identity'), 'principalId'), '')]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the batch account."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('batchAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('batchAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('batchAccount_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('batchAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('batchAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/batch/batch-account/tests/e2e/max/main.test.bicep b/avm/res/batch/batch-account/tests/e2e/max/main.test.bicep
index 8939d05106..c4d73d9a51 100644
--- a/avm/res/batch/batch-account/tests/e2e/max/main.test.bicep
+++ b/avm/res/batch/batch-account/tests/e2e/max/main.test.bicep
@@ -85,9 +85,13 @@ module testDeployment '../../../main.bicep' = [
       poolAllocationMode: 'BatchService'
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'batchAccount'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           tags: {
@@ -136,9 +140,13 @@ module testDeployment '../../../main.bicep' = [
           ]
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'batchAccount'
           subnetResourceId: nestedDependencies.outputs.customSubnet2ResourceId
           tags: {
@@ -148,9 +156,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'nodeManagement'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           tags: {
diff --git a/avm/res/batch/batch-account/tests/e2e/waf-aligned/main.test.bicep b/avm/res/batch/batch-account/tests/e2e/waf-aligned/main.test.bicep
index 72c3a1a51d..76e945d9cb 100644
--- a/avm/res/batch/batch-account/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/batch/batch-account/tests/e2e/waf-aligned/main.test.bicep
@@ -84,9 +84,13 @@ module testDeployment '../../../main.bicep' = [
       poolAllocationMode: 'BatchService'
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'batchAccount'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
diff --git a/avm/res/batch/batch-account/version.json b/avm/res/batch/batch-account/version.json
index 7e1d3f4157..0f81d22abc 100644
--- a/avm/res/batch/batch-account/version.json
+++ b/avm/res/batch/batch-account/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.7",
+    "version": "0.8",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/cache/redis/README.md b/avm/res/cache/redis/README.md
index ca70fcabb7..53940a6aa5 100644
--- a/avm/res/cache/redis/README.md
+++ b/avm/res/cache/redis/README.md
@@ -188,9 +188,13 @@ module redis 'br/public:avm/res/cache/redis:<version>' = {
     minimumTlsVersion: '1.2'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             name: '8d6043f5-8a22-447f-bc31-23d23e09de6c'
@@ -217,9 +221,13 @@ module redis 'br/public:avm/res/cache/redis:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -320,9 +328,13 @@ module redis 'br/public:avm/res/cache/redis:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "name": "8d6043f5-8a22-447f-bc31-23d23e09de6c",
@@ -349,9 +361,13 @@ module redis 'br/public:avm/res/cache/redis:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -557,9 +573,13 @@ module redis 'br/public:avm/res/cache/redis:<version>' = {
     minimumTlsVersion: '1.2'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -646,9 +666,13 @@ module redis 'br/public:avm/res/cache/redis:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -1045,8 +1069,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1230,19 +1253,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1606,6 +1674,7 @@ If the zoneRedundant parameter is true, replicas will be provisioned in the avai
 | `hostName` | string | Redis hostname. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the Redis Cache. |
+| `privateEndpoints` | array | The private endpoints of the Redis Cache. |
 | `resourceGroupName` | string | The name of the resource group the Redis Cache was created in. |
 | `resourceId` | string | The resource ID of the Redis Cache. |
 | `sslPort` | int | Redis SSL port. |
@@ -1618,7 +1687,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/cache/redis/main.bicep b/avm/res/cache/redis/main.bicep
index edc3213985..778d48e0f2 100644
--- a/avm/res/cache/redis/main.bicep
+++ b/avm/res/cache/redis/main.bicep
@@ -259,7 +259,7 @@ resource redis_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-
   }
 ]
 
-module redis_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module redis_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-redis-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -300,8 +300,7 @@ module redis_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -347,6 +346,17 @@ output systemAssignedMIPrincipalId string = redis.?identity.?principalId ?? ''
 @description('The location the resource was deployed into.')
 output location string = redis.location
 
+@description('The private endpoints of the Redis Cache.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: redis_privateEndpoints[i].outputs.name
+    resourceId: redis_privateEndpoints[i].outputs.resourceId
+    groupId: redis_privateEndpoints[i].outputs.groupId
+    customDnsConfig: redis_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: redis_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -383,11 +393,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/cache/redis/main.json b/avm/res/cache/redis/main.json
index 2c8622ea14..ce0660ef3a 100644
--- a/avm/res/cache/redis/main.json
+++ b/avm/res/cache/redis/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "3306342972212004540"
+      "templateHash": "16679190944916422791"
     },
     "name": "Redis Cache",
     "description": "This module deploys a Redis Cache.",
@@ -100,21 +100,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -838,11 +861,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -871,13 +891,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1129,6 +1170,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1164,18 +1228,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1256,7 +1313,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1335,7 +1392,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1346,28 +1403,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1375,12 +1456,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1394,27 +1478,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1481,6 +1574,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1683,6 +1783,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('redis', '2024-03-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Redis Cache."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('redis_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('redis_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('redis_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('redis_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('redis_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/cache/redis/tests/e2e/max/main.test.bicep b/avm/res/cache/redis/tests/e2e/max/main.test.bicep
index 533e03c417..2436361af9 100644
--- a/avm/res/cache/redis/tests/e2e/max/main.test.bicep
+++ b/avm/res/cache/redis/tests/e2e/max/main.test.bicep
@@ -92,9 +92,13 @@ module testDeployment '../../../main.bicep' = [
       zones: [1, 2]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           roleAssignments: [
             {
@@ -124,9 +128,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/cache/redis/tests/e2e/waf-aligned/main.test.bicep b/avm/res/cache/redis/tests/e2e/waf-aligned/main.test.bicep
index 6e86ccb362..d9fa9d90a5 100644
--- a/avm/res/cache/redis/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/cache/redis/tests/e2e/waf-aligned/main.test.bicep
@@ -91,9 +91,13 @@ module testDeployment '../../../main.bicep' = [
       zones: [1, 2, 3]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
diff --git a/avm/res/cache/redis/version.json b/avm/res/cache/redis/version.json
index a8eda31021..e42c3d9e5f 100644
--- a/avm/res/cache/redis/version.json
+++ b/avm/res/cache/redis/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.5",
+    "version": "0.6",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/cognitive-services/account/README.md b/avm/res/cognitive-services/account/README.md
index c681bffea5..9838b6a3e6 100644
--- a/avm/res/cognitive-services/account/README.md
+++ b/avm/res/cognitive-services/account/README.md
@@ -31,23 +31,129 @@ The following section provides usage examples for the module, which were used to
 
 >**Note**: To reference the module, please use the following syntax `br/public:avm/res/cognitive-services/account:<version>`.
 
-- [Using `deployments` in parameter set](#example-1-using-deployments-in-parameter-set)
-- [Using only defaults](#example-2-using-only-defaults)
-- [Using large parameter set](#example-3-using-large-parameter-set)
-- [As Speech Service](#example-4-as-speech-service)
-- [Using Customer-Managed-Keys with System-Assigned identity](#example-5-using-customer-managed-keys-with-system-assigned-identity)
-- [Using Customer-Managed-Keys with User-Assigned identity](#example-6-using-customer-managed-keys-with-user-assigned-identity)
-- [WAF-aligned](#example-7-waf-aligned)
+- [Using `AIServices` with `deployments` in parameter set and private endpoints](#example-1-using-aiservices-with-deployments-in-parameter-set-and-private-endpoints)
+- [Using `AIServices` with `deployments` in parameter set](#example-2-using-aiservices-with-deployments-in-parameter-set)
+- [Using only defaults](#example-3-using-only-defaults)
+- [Using large parameter set](#example-4-using-large-parameter-set)
+- [Using `OpenAI` and `deployments` in parameter set with private endpoint](#example-5-using-openai-and-deployments-in-parameter-set-with-private-endpoint)
+- [As Speech Service](#example-6-as-speech-service)
+- [Using Customer-Managed-Keys with System-Assigned identity](#example-7-using-customer-managed-keys-with-system-assigned-identity)
+- [Using Customer-Managed-Keys with User-Assigned identity](#example-8-using-customer-managed-keys-with-user-assigned-identity)
+- [WAF-aligned](#example-9-waf-aligned)
 
-### Example 1: _Using `deployments` in parameter set_
+### Example 1: _Using `AIServices` with `deployments` in parameter set and private endpoints_
 
-This instance deploys the module with the AI model deployment feature.'
+This instance deploys the module with the AI model deployment feature and private endpoint.
 
-Note, this test is temporarily disabled as it needs to be enabled on the subscription.
-As we don't want other contributions from being blocked by this, we disabled the test for now / rely on a manual execution outside the CI environemnt
-You can find more information here: https://learn.microsoft.com/en-us/legal/cognitive-services/openai/limited-access
-And register here: https://aka.ms/oai/access
 
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module account 'br/public:avm/res/cognitive-services/account:<version>' = {
+  name: 'accountDeployment'
+  params: {
+    // Required parameters
+    kind: 'AIServices'
+    name: 'csadp003'
+    // Non-required parameters
+    customSubDomainName: 'xcsadpai'
+    deployments: [
+      {
+        model: {
+          format: 'OpenAI'
+          name: 'gpt-35-turbo'
+          version: '0301'
+        }
+        name: 'gpt-35-turbo'
+        sku: {
+          capacity: 10
+          name: 'Standard'
+        }
+      }
+    ]
+    location: '<location>'
+    privateEndpoints: [
+      {
+        privateDnsZoneResourceIds: [
+          '<privateDNSZoneOpenAIResourceId>'
+          '<privateDNSZoneResourceId>'
+        ]
+        subnetResourceId: '<subnetResourceId>'
+      }
+    ]
+    publicNetworkAccess: 'Disabled'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "kind": {
+      "value": "AIServices"
+    },
+    "name": {
+      "value": "csadp003"
+    },
+    // Non-required parameters
+    "customSubDomainName": {
+      "value": "xcsadpai"
+    },
+    "deployments": {
+      "value": [
+        {
+          "model": {
+            "format": "OpenAI",
+            "name": "gpt-35-turbo",
+            "version": "0301"
+          },
+          "name": "gpt-35-turbo",
+          "sku": {
+            "capacity": 10,
+            "name": "Standard"
+          }
+        }
+      ]
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "privateEndpoints": {
+      "value": [
+        {
+          "privateDnsZoneResourceIds": [
+            "<privateDNSZoneOpenAIResourceId>",
+            "<privateDNSZoneResourceId>"
+          ],
+          "subnetResourceId": "<subnetResourceId>"
+        }
+      ]
+    },
+    "publicNetworkAccess": {
+      "value": "Disabled"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 2: _Using `AIServices` with `deployments` in parameter set_
+
+This instance deploys the module with the AI model deployment feature.
 
 
 <details>
@@ -131,7 +237,7 @@ module account 'br/public:avm/res/cognitive-services/account:<version>' = {
 </details>
 <p>
 
-### Example 2: _Using only defaults_
+### Example 3: _Using only defaults_
 
 This instance deploys the module with the minimum set of required parameters.
 
@@ -183,7 +289,7 @@ module account 'br/public:avm/res/cognitive-services/account:<version>' = {
 </details>
 <p>
 
-### Example 3: _Using large parameter set_
+### Example 4: _Using large parameter set_
 
 This instance deploys the module with most of its features enabled.
 
@@ -475,7 +581,115 @@ module account 'br/public:avm/res/cognitive-services/account:<version>' = {
 </details>
 <p>
 
-### Example 4: _As Speech Service_
+### Example 5: _Using `OpenAI` and `deployments` in parameter set with private endpoint_
+
+This instance deploys the module with the AI model deployment feature and private endpoint.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module account 'br/public:avm/res/cognitive-services/account:<version>' = {
+  name: 'accountDeployment'
+  params: {
+    // Required parameters
+    kind: 'OpenAI'
+    name: 'csoai002'
+    // Non-required parameters
+    customSubDomainName: 'xcsoaiai'
+    deployments: [
+      {
+        model: {
+          format: 'OpenAI'
+          name: 'gpt-35-turbo'
+          version: '0301'
+        }
+        name: 'gpt-35-turbo'
+        sku: {
+          capacity: 10
+          name: 'Standard'
+        }
+      }
+    ]
+    location: '<location>'
+    privateEndpoints: [
+      {
+        privateDnsZoneResourceIds: [
+          '<privateDNSZoneResourceId>'
+        ]
+        subnetResourceId: '<subnetResourceId>'
+      }
+    ]
+    publicNetworkAccess: 'Disabled'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "kind": {
+      "value": "OpenAI"
+    },
+    "name": {
+      "value": "csoai002"
+    },
+    // Non-required parameters
+    "customSubDomainName": {
+      "value": "xcsoaiai"
+    },
+    "deployments": {
+      "value": [
+        {
+          "model": {
+            "format": "OpenAI",
+            "name": "gpt-35-turbo",
+            "version": "0301"
+          },
+          "name": "gpt-35-turbo",
+          "sku": {
+            "capacity": 10,
+            "name": "Standard"
+          }
+        }
+      ]
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "privateEndpoints": {
+      "value": [
+        {
+          "privateDnsZoneResourceIds": [
+            "<privateDNSZoneResourceId>"
+          ],
+          "subnetResourceId": "<subnetResourceId>"
+        }
+      ]
+    },
+    "publicNetworkAccess": {
+      "value": "Disabled"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 6: _As Speech Service_
 
 This instance deploys the module as a Speech Service.
 
@@ -589,7 +803,7 @@ module account 'br/public:avm/res/cognitive-services/account:<version>' = {
 </details>
 <p>
 
-### Example 5: _Using Customer-Managed-Keys with System-Assigned identity_
+### Example 7: _Using Customer-Managed-Keys with System-Assigned identity_
 
 This instance deploys the module using Customer-Managed-Keys using a System-Assigned Identity. This required the service to be deployed twice, once as a pre-requisite to create the System-Assigned Identity, and once to use it for accessing the Customer-Managed-Key secret.
 
@@ -671,7 +885,7 @@ module account 'br/public:avm/res/cognitive-services/account:<version>' = {
 </details>
 <p>
 
-### Example 6: _Using Customer-Managed-Keys with User-Assigned identity_
+### Example 8: _Using Customer-Managed-Keys with User-Assigned identity_
 
 This instance deploys the module using Customer-Managed-Keys using a User-Assigned Identity to access the Customer-Managed-Key secret.
 
@@ -759,7 +973,7 @@ module account 'br/public:avm/res/cognitive-services/account:<version>' = {
 </details>
 <p>
 
-### Example 7: _WAF-aligned_
+### Example 9: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
diff --git a/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment-private/dependencies.bicep b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment-private/dependencies.bicep
new file mode 100644
index 0000000000..7ce71d5a43
--- /dev/null
+++ b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment-private/dependencies.bicep
@@ -0,0 +1,87 @@
+@description('Optional. The location to deploy resources to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+@description('Required. The name of the Managed Identity to create.')
+param managedIdentityName string
+
+var addressPrefix = '10.0.0.0/16'
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+          serviceEndpoints: [
+            {
+              service: 'Microsoft.CognitiveServices'
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
+
+resource privateDNSZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
+  name: 'privatelink.cognitiveservices.azure.com'
+  location: 'global'
+
+  resource virtualNetworkLinks 'virtualNetworkLinks@2020-06-01' = {
+    name: '${virtualNetwork.name}-vnetlink'
+    location: 'global'
+    properties: {
+      virtualNetwork: {
+        id: virtualNetwork.id
+      }
+      registrationEnabled: false
+    }
+  }
+}
+
+resource privateDNSZoneOpenAI 'Microsoft.Network/privateDnsZones@2020-06-01' = {
+  name: 'privatelink.openai.azure.com'
+  location: 'global'
+
+  resource virtualNetworkLinks 'virtualNetworkLinks@2020-06-01' = {
+    name: '${virtualNetwork.name}-vnetlink'
+    location: 'global'
+    properties: {
+      virtualNetwork: {
+        id: virtualNetwork.id
+      }
+      registrationEnabled: false
+    }
+  }
+}
+
+resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
+  name: managedIdentityName
+  location: location
+}
+
+@description('The resource ID of the created Virtual Network Subnet.')
+output subnetResourceId string = virtualNetwork.properties.subnets[0].id
+
+@description('The resource ID of the created Managed Identity.')
+output managedIdentityResourceId string = managedIdentity.id
+
+@description('The principal ID of the created Managed Identity.')
+output managedIdentityPrincipalId string = managedIdentity.properties.principalId
+
+@description('The resource ID of the created Private DNS zone.')
+output privateDNSZoneResourceId string = privateDNSZone.id
+
+@description('The resource ID of the created Private DNS zone for OpenAI.')
+output privateDNSZoneOpenAIResourceId string = privateDNSZoneOpenAI.id
diff --git a/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment-private/main.test.bicep b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment-private/main.test.bicep
new file mode 100644
index 0000000000..fda05f65f1
--- /dev/null
+++ b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment-private/main.test.bicep
@@ -0,0 +1,84 @@
+targetScope = 'subscription'
+
+metadata name = 'Using `AIServices` with `deployments` in parameter set and private endpoints'
+metadata description = 'This instance deploys the module with the AI model deployment feature and private endpoint.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-cognitiveservices.accounts-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'csadp'
+
+@description('Optional. A token to inject into the name of each resource. This value can be automatically injected by the CI.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2022-09-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    location: resourceLocation
+  }
+}
+
+
+// ============== //
+// Test Execution //
+// ============== //
+
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: if (true == false) {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}-ai'
+    params: {
+      name: '${namePrefix}${serviceShort}003'
+      kind: 'AIServices'
+      location: resourceLocation
+      customSubDomainName: '${namePrefix}x${serviceShort}ai'
+      deployments: [
+        {
+          name: 'gpt-35-turbo'
+          model: {
+            format: 'OpenAI'
+            name: 'gpt-35-turbo'
+            version: '0301'
+          }
+          sku: {
+            name: 'Standard'
+            capacity: 10
+          }
+        }
+      ]
+      publicNetworkAccess: 'Disabled'
+      privateEndpoints: [
+        {
+          privateDnsZoneResourceIds: [
+            nestedDependencies.outputs.privateDNSZoneResourceId
+            nestedDependencies.outputs.privateDNSZoneOpenAIResourceId
+          ]
+          subnetResourceId: nestedDependencies.outputs.subnetResourceId
+        }
+      ]
+    }
+  }
+]
diff --git a/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/main.test.bicep b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/main.test.bicep
index 60d04523d3..50301f23e5 100644
--- a/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/main.test.bicep
+++ b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/main.test.bicep
@@ -1,14 +1,7 @@
 targetScope = 'subscription'
 
-metadata name = 'Using `deployments` in parameter set'
-metadata description = '''
-This instance deploys the module with the AI model deployment feature.'
-
-Note, this test is temporarily disabled as it needs to be enabled on the subscription.
-As we don't want other contributions from being blocked by this, we disabled the test for now / rely on a manual execution outside the CI environemnt
-You can find more information here: https://learn.microsoft.com/en-us/legal/cognitive-services/openai/limited-access
-And register here: https://aka.ms/oai/access
-'''
+metadata name = 'Using `AIServices` with `deployments` in parameter set'
+metadata description = 'This instance deploys the module with the AI model deployment feature.'
 
 // ========== //
 // Parameters //
@@ -43,7 +36,7 @@ resource resourceGroup 'Microsoft.Resources/resourceGroups@2022-09-01' = {
 // ============== //
 
 module testDeployment '../../../main.bicep' = [
-  for iteration in ['init', 'idem']: if (true == false) {
+  for iteration in ['init', 'idem']: {
     scope: resourceGroup
     name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}-ai'
     params: {
diff --git a/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/warning.tests.ps1 b/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/warning.tests.ps1
deleted file mode 100644
index 21deb1f6a3..0000000000
--- a/avm/res/cognitive-services/account/tests/e2e/ai-model-deployment/warning.tests.ps1
+++ /dev/null
@@ -1,24 +0,0 @@
-######################################
-## Additional post-deployment tests ##
-######################################
-##
-## You can add any custom post-deployment validation tests you want here, or add them spread accross multiple test files in the test case folder.
-##
-###########################
-
-param (
-    [Parameter(Mandatory = $false)]
-    [hashtable] $TestInputData = @{}
-)
-
-Describe 'Warning' {
-
-    It 'Disabled test' {
-
-        Write-Output @{
-            Warning = "Note, the OpenAI-Deployments test is temporarily disabled as it needs to be enabled on the subscription.<br>As we don't want other contributions from being blocked by this, we disabled the test for now / rely on a manual execution outside the CI environemnt. For more information please review the [offical docs](https://learn.microsoft.com/en-us/legal/cognitive-services/openai/limited-access) and or register [here](https://aka.ms/oai/access"
-
-        }
-    }
-}
-
diff --git a/avm/res/cognitive-services/account/tests/e2e/openai-private/dependencies.bicep b/avm/res/cognitive-services/account/tests/e2e/openai-private/dependencies.bicep
new file mode 100644
index 0000000000..129b6f6579
--- /dev/null
+++ b/avm/res/cognitive-services/account/tests/e2e/openai-private/dependencies.bicep
@@ -0,0 +1,68 @@
+@description('Optional. The location to deploy resources to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+@description('Required. The name of the Managed Identity to create.')
+param managedIdentityName string
+
+var addressPrefix = '10.0.0.0/16'
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+          serviceEndpoints: [
+            {
+              service: 'Microsoft.CognitiveServices'
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
+
+resource privateDNSZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
+  name: 'privatelink.cognitiveservices.azure.com'
+  location: 'global'
+
+  resource virtualNetworkLinks 'virtualNetworkLinks@2020-06-01' = {
+    name: '${virtualNetwork.name}-vnetlink'
+    location: 'global'
+    properties: {
+      virtualNetwork: {
+        id: virtualNetwork.id
+      }
+      registrationEnabled: false
+    }
+  }
+}
+
+resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
+  name: managedIdentityName
+  location: location
+}
+
+@description('The resource ID of the created Virtual Network Subnet.')
+output subnetResourceId string = virtualNetwork.properties.subnets[0].id
+
+@description('The resource ID of the created Managed Identity.')
+output managedIdentityResourceId string = managedIdentity.id
+
+@description('The principal ID of the created Managed Identity.')
+output managedIdentityPrincipalId string = managedIdentity.properties.principalId
+
+@description('The resource ID of the created Private DNS zone.')
+output privateDNSZoneResourceId string = privateDNSZone.id
diff --git a/avm/res/cognitive-services/account/tests/e2e/openai-private/main.test.bicep b/avm/res/cognitive-services/account/tests/e2e/openai-private/main.test.bicep
new file mode 100644
index 0000000000..046f81ead1
--- /dev/null
+++ b/avm/res/cognitive-services/account/tests/e2e/openai-private/main.test.bicep
@@ -0,0 +1,83 @@
+targetScope = 'subscription'
+
+metadata name = 'Using `OpenAI` and `deployments` in parameter set with private endpoint'
+metadata description = 'This instance deploys the module with the AI model deployment feature and private endpoint.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-cognitiveservices.accounts-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'csoai'
+
+@description('Optional. A token to inject into the name of each resource. This value can be automatically injected by the CI.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2022-09-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    location: resourceLocation
+  }
+}
+
+
+// ============== //
+// Test Execution //
+// ============== //
+
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}-oai'
+    params: {
+      name: '${namePrefix}${serviceShort}002'
+      kind: 'OpenAI'
+      location: resourceLocation
+      customSubDomainName: '${namePrefix}x${serviceShort}ai'
+      deployments: [
+        {
+          name: 'gpt-35-turbo'
+          model: {
+            format: 'OpenAI'
+            name: 'gpt-35-turbo'
+            version: '0301'
+          }
+          sku: {
+            name: 'Standard'
+            capacity: 10
+          }
+        }
+      ]
+      publicNetworkAccess: 'Disabled'
+      privateEndpoints: [
+        {
+          privateDnsZoneResourceIds: [
+            nestedDependencies.outputs.privateDNSZoneResourceId
+          ]
+          subnetResourceId: nestedDependencies.outputs.subnetResourceId
+        }
+      ]
+    }
+  }
+]
diff --git a/avm/res/compute/disk/README.md b/avm/res/compute/disk/README.md
index 555a2c0fdd..be1624c4f6 100644
--- a/avm/res/compute/disk/README.md
+++ b/avm/res/compute/disk/README.md
@@ -474,7 +474,7 @@ module disk 'br/public:avm/res/compute/disk:<version>' = {
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`availabilityZone`](#parameter-availabilityzone) | int | If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used. |
+| [`availabilityZone`](#parameter-availabilityzone) | int | If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used. Note that the availability zone number here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone.To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones) and [Distribute VMs and disks across availability zones](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-high-availability#distribute-vms-and-disks-across-availability-zones). |
 | [`name`](#parameter-name) | string | The name of the disk that is being created. |
 | [`sku`](#parameter-sku) | string | The disks sku name. Can be . |
 
@@ -517,7 +517,7 @@ module disk 'br/public:avm/res/compute/disk:<version>' = {
 
 ### Parameter: `availabilityZone`
 
-If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used.
+If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used. Note that the availability zone number here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone.To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones) and [Distribute VMs and disks across availability zones](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-high-availability#distribute-vms-and-disks-across-availability-zones).
 
 - Required: Yes
 - Type: int
@@ -549,7 +549,6 @@ The disks sku name. Can be .
   [
     'Premium_LRS'
     'Premium_ZRS'
-    'Premium_ZRS'
     'PremiumV2_LRS'
     'Standard_LRS'
     'StandardSSD_LRS'
diff --git a/avm/res/compute/disk/main.bicep b/avm/res/compute/disk/main.bicep
index 586e1c3b48..38bde0070e 100644
--- a/avm/res/compute/disk/main.bicep
+++ b/avm/res/compute/disk/main.bicep
@@ -14,7 +14,6 @@ param location string = resourceGroup().location
   'StandardSSD_LRS'
   'UltraSSD_LRS'
   'Premium_ZRS'
-  'Premium_ZRS'
   'PremiumV2_LRS'
 ])
 @description('Required. The disks sku name. Can be .')
@@ -125,7 +124,7 @@ param publicNetworkAccess string = 'Disabled'
 @description('Optional. True if the image from which the OS disk is created supports accelerated networking.')
 param acceleratedNetwork bool = false
 
-@description('Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used.')
+@description('Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used. Note that the availability zone number here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone.To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones) and [Distribute VMs and disks across availability zones](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-high-availability#distribute-vms-and-disks-across-availability-zones).')
 @allowed([
   0
   1
diff --git a/avm/res/compute/disk/main.json b/avm/res/compute/disk/main.json
index c728b4f0c2..a7a1c1ce18 100644
--- a/avm/res/compute/disk/main.json
+++ b/avm/res/compute/disk/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "4766813153127596878"
+      "templateHash": "14687427563063774670"
     },
     "name": "Compute Disks",
     "description": "This module deploys a Compute Disk",
@@ -134,7 +134,6 @@
         "StandardSSD_LRS",
         "UltraSSD_LRS",
         "Premium_ZRS",
-        "Premium_ZRS",
         "PremiumV2_LRS"
       ],
       "metadata": {
@@ -343,7 +342,7 @@
         3
       ],
       "metadata": {
-        "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used."
+        "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If zero, then availability zones are not used. Note that the availability zone number here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone.To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones) and [Distribute VMs and disks across availability zones](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-high-availability#distribute-vms-and-disks-across-availability-zones)."
       }
     },
     "lock": {
diff --git a/avm/res/compute/virtual-machine-scale-set/README.md b/avm/res/compute/virtual-machine-scale-set/README.md
index fb828ac655..730b23f033 100644
--- a/avm/res/compute/virtual-machine-scale-set/README.md
+++ b/avm/res/compute/virtual-machine-scale-set/README.md
@@ -1370,7 +1370,7 @@ module virtualMachineScaleSet 'br/public:avm/res/compute/virtual-machine-scale-s
         workspaceResourceId: '<workspaceResourceId>'
       }
     ]
-    encryptionAtHost: '<encryptionAtHost>'
+    encryptionAtHost: false
     extensionAntiMalwareConfig: {
       enabled: true
       settings: {
@@ -1529,7 +1529,7 @@ module virtualMachineScaleSet 'br/public:avm/res/compute/virtual-machine-scale-s
       ]
     },
     "encryptionAtHost": {
-      "value": "<encryptionAtHost>"
+      "value": false
     },
     "extensionAntiMalwareConfig": {
       "value": {
diff --git a/avm/res/compute/virtual-machine/README.md b/avm/res/compute/virtual-machine/README.md
index 84fe3bab53..f34080a1bc 100644
--- a/avm/res/compute/virtual-machine/README.md
+++ b/avm/res/compute/virtual-machine/README.md
@@ -19,10 +19,11 @@ This module deploys a Virtual Machine with one or multiple NICs and optionally o
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
 | `Microsoft.Automanage/configurationProfileAssignments` | [2022-05-04](https://learn.microsoft.com/en-us/azure/templates) |
-| `Microsoft.Compute/virtualMachines` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2023-09-01/virtualMachines) |
+| `Microsoft.Compute/virtualMachines` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2024-03-01/virtualMachines) |
 | `Microsoft.Compute/virtualMachines/extensions` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Compute/2022-11-01/virtualMachines/extensions) |
 | `Microsoft.DevTestLab/schedules` | [2018-09-15](https://learn.microsoft.com/en-us/azure/templates/Microsoft.DevTestLab/2018-09-15/schedules) |
 | `Microsoft.GuestConfiguration/guestConfigurationAssignments` | [2020-06-25](https://learn.microsoft.com/en-us/azure/templates/Microsoft.GuestConfiguration/2020-06-25/guestConfigurationAssignments) |
+| `Microsoft.Insights/dataCollectionRuleAssociations` | [2023-03-11](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2023-03-11/dataCollectionRuleAssociations) |
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
 | `Microsoft.Maintenance/configurationAssignments` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Maintenance/2023-04-01/configurationAssignments) |
 | `Microsoft.Network/networkInterfaces` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkInterfaces) |
@@ -565,8 +566,13 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
       }
     }
     extensionMonitoringAgentConfig: {
+      dataCollectionRuleAssociations: [
+        {
+          dataCollectionRuleResourceId: '<dataCollectionRuleResourceId>'
+          name: 'SendMetricsToLAW'
+        }
+      ]
       enabled: true
-      monitoringWorkspaceResourceId: '<monitoringWorkspaceResourceId>'
       tags: {
         Environment: 'Non-Prod'
         'hidden-title': 'This is visible in the resource name'
@@ -892,8 +898,13 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
     },
     "extensionMonitoringAgentConfig": {
       "value": {
+        "dataCollectionRuleAssociations": [
+          {
+            "dataCollectionRuleResourceId": "<dataCollectionRuleResourceId>",
+            "name": "SendMetricsToLAW"
+          }
+        ],
         "enabled": true,
-        "monitoringWorkspaceResourceId": "<monitoringWorkspaceResourceId>",
         "tags": {
           "Environment": "Non-Prod",
           "hidden-title": "This is visible in the resource name",
@@ -1196,6 +1207,12 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
       }
     }
     extensionMonitoringAgentConfig: {
+      dataCollectionRuleAssociations: [
+        {
+          dataCollectionRuleResourceId: '<dataCollectionRuleResourceId>'
+          name: 'SendMetricsToLAW'
+        }
+      ]
       enabled: true
       tags: {
         Environment: 'Non-Prod'
@@ -1518,6 +1535,12 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
     },
     "extensionMonitoringAgentConfig": {
       "value": {
+        "dataCollectionRuleAssociations": [
+          {
+            "dataCollectionRuleResourceId": "<dataCollectionRuleResourceId>",
+            "name": "SendMetricsToLAW"
+          }
+        ],
         "enabled": true,
         "tags": {
           "Environment": "Non-Prod",
@@ -2332,8 +2355,13 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
       }
     }
     extensionMonitoringAgentConfig: {
+      dataCollectionRuleAssociations: [
+        {
+          dataCollectionRuleResourceId: '<dataCollectionRuleResourceId>'
+          name: 'SendMetricsToLAW'
+        }
+      ]
       enabled: true
-      monitoringWorkspaceResourceId: '<monitoringWorkspaceResourceId>'
       tags: {
         Environment: 'Non-Prod'
         'hidden-title': 'This is visible in the resource name'
@@ -2693,8 +2721,13 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
     },
     "extensionMonitoringAgentConfig": {
       "value": {
+        "dataCollectionRuleAssociations": [
+          {
+            "dataCollectionRuleResourceId": "<dataCollectionRuleResourceId>",
+            "name": "SendMetricsToLAW"
+          }
+        ],
         "enabled": true,
-        "monitoringWorkspaceResourceId": "<monitoringWorkspaceResourceId>",
         "tags": {
           "Environment": "Non-Prod",
           "hidden-title": "This is visible in the resource name",
@@ -3219,6 +3252,7 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
 | [`disablePasswordAuthentication`](#parameter-disablepasswordauthentication) | bool | Specifies whether password authentication should be disabled. |
 | [`enableAutomaticUpdates`](#parameter-enableautomaticupdates) | bool | Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning. |
 | [`enableEvictionPolicy`](#parameter-enableevictionpolicy) | bool | Specifies the eviction policy for the low priority virtual machine. Will result in 'Deallocate' eviction policy. |
+| [`enableHotpatching`](#parameter-enablehotpatching) | bool | Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
 | [`encryptionAtHost`](#parameter-encryptionathost) | bool | This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs. |
 | [`extensionAadJoinConfig`](#parameter-extensionaadjoinconfig) | object | The configuration for the [AAD Join] extension. Must at least contain the ["enabled": true] property to be executed. To enroll in Intune, add the setting mdmId: "0000000a-0000-0000-c000-000000000000". |
@@ -3255,7 +3289,7 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:<version>' = {
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
 | [`sasTokenValidityLength`](#parameter-sastokenvaliditylength) | string | SAS token validity length to use to download files from storage accounts. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours. |
 | [`secureBootEnabled`](#parameter-securebootenabled) | bool | Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings. |
-| [`securityType`](#parameter-securitytype) | string | Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings. |
+| [`securityType`](#parameter-securitytype) | string | Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set. |
 | [`tags`](#parameter-tags) | object | Tags of the resource. |
 | [`timeZone`](#parameter-timezone) | string | Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`. |
 | [`ultraSSDEnabled`](#parameter-ultrassdenabled) | bool | The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled. |
@@ -3749,6 +3783,14 @@ Specifies the eviction policy for the low priority virtual machine. Will result
 - Type: bool
 - Default: `False`
 
+### Parameter: `enableHotpatching`
+
+Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
 ### Parameter: `enableTelemetry`
 
 Enable/Disable usage telemetry for module.
@@ -3911,6 +3953,7 @@ The configuration for the [Monitoring Agent] extension. Must at least contain th
 - Default:
   ```Bicep
   {
+      dataCollectionRuleAssociations: []
       enabled: false
   }
   ```
@@ -4276,11 +4319,19 @@ Specifies whether secure boot should be enabled on the virtual machine. This par
 
 ### Parameter: `securityType`
 
-Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings.
+Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set.
 
 - Required: No
 - Type: string
 - Default: `''`
+- Allowed:
+  ```Bicep
+  [
+    ''
+    'ConfidentialVM'
+    'TrustedLaunch'
+  ]
+  ```
 
 ### Parameter: `tags`
 
diff --git a/avm/res/compute/virtual-machine/main.bicep b/avm/res/compute/virtual-machine/main.bicep
index d6ac66d367..0a4f4f476a 100644
--- a/avm/res/compute/virtual-machine/main.bicep
+++ b/avm/res/compute/virtual-machine/main.bicep
@@ -14,7 +14,12 @@ param vmSize string
 @description('Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs.')
 param encryptionAtHost bool = true
 
-@description('Optional. Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings.')
+@description('Optional. Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set.')
+@allowed([
+  ''
+  'ConfidentialVM'
+  'TrustedLaunch'
+])
 param securityType string = ''
 
 @description('Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings.')
@@ -159,6 +164,7 @@ param extensionAntiMalwareConfig object = {
 @description('Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the ["enabled": true] property to be executed.')
 param extensionMonitoringAgentConfig object = {
   enabled: false
+  dataCollectionRuleAssociations: []
 }
 
 @description('Optional. The configuration for the [Dependency Agent] extension. Must at least contain the ["enabled": true] property to be executed.')
@@ -281,6 +287,9 @@ param rebootSetting string = 'IfRequired'
 ])
 param patchAssessmentMode string = 'ImageDefault'
 
+@description('Optional. Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the \'provisionVMAgent\' must be set to true and \'patchMode\' must be set to \'AutomaticByPlatform\'.')
+param enableHotpatching bool = false
+
 @description('Optional. Specifies the time zone of the virtual machine. e.g. \'Pacific Standard Time\'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`.')
 param timeZone string = ''
 
@@ -327,6 +336,7 @@ var windowsConfiguration = {
     ? {
         patchMode: patchMode
         assessmentMode: patchAssessmentMode
+        enableHotpatching: (patchMode =~ 'AutomaticByPlatform') ? enableHotpatching : false
         automaticByPlatformSettings: (patchMode =~ 'AutomaticByPlatform')
           ? {
               bypassPlatformSafetyChecksOnUserSchedule: bypassPlatformSafetyChecksOnUserSchedule
@@ -493,7 +503,7 @@ module vm_nic 'modules/nic-configuration.bicep' = [
   }
 ]
 
-resource vm 'Microsoft.Compute/virtualMachines@2023-09-01' = {
+resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = {
   name: name
   location: location
   identity: identity
@@ -749,29 +759,6 @@ module vm_microsoftAntiMalwareExtension 'extension/main.bicep' = if (extensionAn
   ]
 }
 
-resource vm_logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = if (!empty(extensionMonitoringAgentConfig.?monitoringWorkspaceId)) {
-  name: last(split(
-    (!empty(extensionMonitoringAgentConfig.?monitoringWorkspaceId ?? '')
-      ? extensionMonitoringAgentConfig.monitoringWorkspaceId
-      : 'law'),
-    '/'
-  ))!
-  scope: az.resourceGroup(
-    split(
-      (!empty(extensionMonitoringAgentConfig.?monitoringWorkspaceId ?? '')
-        ? extensionMonitoringAgentConfig.monitoringWorkspaceId
-        : '//'),
-      '/'
-    )[2],
-    split(
-      (!empty(extensionMonitoringAgentConfig.?monitoringWorkspaceId ?? '')
-        ? extensionMonitoringAgentConfig.monitoringWorkspaceId
-        : '////'),
-      '/'
-    )[4]
-  )
-}
-
 module vm_azureMonitorAgentExtension 'extension/main.bicep' = if (extensionMonitoringAgentConfig.enabled) {
   name: '${uniqueString(deployment().name, location)}-VM-AzureMonitorAgent'
   params: {
@@ -783,25 +770,27 @@ module vm_azureMonitorAgentExtension 'extension/main.bicep' = if (extensionMonit
     typeHandlerVersion: extensionMonitoringAgentConfig.?typeHandlerVersion ?? (osType == 'Windows' ? '1.22' : '1.29')
     autoUpgradeMinorVersion: extensionMonitoringAgentConfig.?autoUpgradeMinorVersion ?? true
     enableAutomaticUpgrade: extensionMonitoringAgentConfig.?enableAutomaticUpgrade ?? false
-    settings: {
-      workspaceId: !empty(extensionMonitoringAgentConfig.?monitoringWorkspaceId ?? '')
-        ? vm_logAnalyticsWorkspace.properties.customerId
-        : ''
-      GCS_AUTO_CONFIG: osType == 'Linux' ? true : null
-    }
     supressFailures: extensionMonitoringAgentConfig.?supressFailures ?? false
     tags: extensionMonitoringAgentConfig.?tags ?? tags
-    protectedSettings: {
-      workspaceKey: !empty(extensionMonitoringAgentConfig.?monitoringWorkspaceId ?? '')
-        ? vm_logAnalyticsWorkspace.listKeys().primarySharedKey
-        : ''
-    }
   }
   dependsOn: [
     vm_microsoftAntiMalwareExtension
   ]
 }
 
+resource vm_dataCollectionRuleAssociations 'Microsoft.Insights/dataCollectionRuleAssociations@2023-03-11' = [
+  for (dataCollectionRuleAssociation, index) in extensionMonitoringAgentConfig.dataCollectionRuleAssociations: if (extensionMonitoringAgentConfig.enabled) {
+    name: dataCollectionRuleAssociation.name
+    scope: vm
+    properties: {
+      dataCollectionRuleId: dataCollectionRuleAssociation.dataCollectionRuleResourceId
+    }
+    dependsOn: [
+      vm_azureMonitorAgentExtension
+    ]
+  }
+]
+
 module vm_dependencyAgentExtension 'extension/main.bicep' = if (extensionDependencyAgentConfig.enabled) {
   name: '${uniqueString(deployment().name, location)}-VM-DependencyAgent'
   params: {
diff --git a/avm/res/compute/virtual-machine/main.json b/avm/res/compute/virtual-machine/main.json
index 431d7aa3f9..dc46cdf5ed 100644
--- a/avm/res/compute/virtual-machine/main.json
+++ b/avm/res/compute/virtual-machine/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "17468959759450172802"
+      "templateHash": "17996854249282289438"
     },
     "name": "Virtual Machines",
     "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs.",
@@ -344,8 +344,13 @@
     "securityType": {
       "type": "string",
       "defaultValue": "",
+      "allowedValues": [
+        "",
+        "ConfidentialVM",
+        "TrustedLaunch"
+      ],
       "metadata": {
-        "description": "Optional. Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings."
+        "description": "Optional. Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set."
       }
     },
     "secureBootEnabled": {
@@ -625,7 +630,8 @@
     "extensionMonitoringAgentConfig": {
       "type": "object",
       "defaultValue": {
-        "enabled": false
+        "enabled": false,
+        "dataCollectionRuleAssociations": []
       },
       "metadata": {
         "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
@@ -848,6 +854,13 @@
         "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
       }
     },
+    "enableHotpatching": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'."
+      }
+    },
     "timeZone": {
       "type": "string",
       "defaultValue": "",
@@ -904,7 +917,7 @@
     "windowsConfiguration": {
       "provisionVMAgent": "[parameters('provisionVMAgent')]",
       "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
-      "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+      "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'enableHotpatching', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), parameters('enableHotpatching'), false()), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
       "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
       "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), parameters('additionalUnattendContent'))]",
       "winRM": "[if(not(empty(parameters('winRM'))), createObject('listeners', parameters('winRM')), null())]"
@@ -962,7 +975,7 @@
     },
     "vm": {
       "type": "Microsoft.Compute/virtualMachines",
-      "apiVersion": "2023-09-01",
+      "apiVersion": "2024-03-01",
       "name": "[parameters('name')]",
       "location": "[parameters('location')]",
       "identity": "[variables('identity')]",
@@ -1110,14 +1123,23 @@
         "vm"
       ]
     },
-    "vm_logAnalyticsWorkspace": {
-      "condition": "[not(empty(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId')))]",
-      "existing": true,
-      "type": "Microsoft.OperationalInsights/workspaces",
-      "apiVersion": "2021-06-01",
-      "subscriptionId": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2]]",
-      "resourceGroup": "[split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]]",
-      "name": "[last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))]"
+    "vm_dataCollectionRuleAssociations": {
+      "copy": {
+        "name": "vm_dataCollectionRuleAssociations",
+        "count": "[length(parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations)]"
+      },
+      "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+      "type": "Microsoft.Insights/dataCollectionRuleAssociations",
+      "apiVersion": "2023-03-11",
+      "scope": "[format('Microsoft.Compute/virtualMachines/{0}', parameters('name'))]",
+      "name": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].name]",
+      "properties": {
+        "dataCollectionRuleId": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].dataCollectionRuleResourceId]"
+      },
+      "dependsOn": [
+        "vm",
+        "vm_azureMonitorAgentExtension"
+      ]
     },
     "AzureWindowsBaseline": {
       "condition": "[not(empty(parameters('guestConfiguration')))]",
@@ -3379,22 +3401,11 @@
           "enableAutomaticUpgrade": {
             "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
           },
-          "settings": {
-            "value": {
-              "workspaceId": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), reference('vm_logAnalyticsWorkspace').customerId, '')]",
-              "GCS_AUTO_CONFIG": "[if(equals(parameters('osType'), 'Linux'), true(), null())]"
-            }
-          },
           "supressFailures": {
             "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
           },
           "tags": {
             "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
-          },
-          "protectedSettings": {
-            "value": {
-              "workspaceKey": "[if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '//'), '/')[2], split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, '////'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(if(not(empty(coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'monitoringWorkspaceId'), ''))), parameters('extensionMonitoringAgentConfig').monitoringWorkspaceId, 'law'), '/'))), '2021-06-01').primarySharedKey, '')]"
-            }
           }
         },
         "template": {
@@ -3560,7 +3571,6 @@
       },
       "dependsOn": [
         "vm",
-        "vm_logAnalyticsWorkspace",
         "vm_microsoftAntiMalwareExtension"
       ]
     },
@@ -5380,14 +5390,14 @@
       "metadata": {
         "description": "The principal ID of the system assigned identity."
       },
-      "value": "[coalesce(tryGet(tryGet(reference('vm', '2023-09-01', 'full'), 'identity'), 'principalId'), '')]"
+      "value": "[coalesce(tryGet(tryGet(reference('vm', '2024-03-01', 'full'), 'identity'), 'principalId'), '')]"
     },
     "location": {
       "type": "string",
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('vm', '2023-09-01', 'full').location]"
+      "value": "[reference('vm', '2024-03-01', 'full').location]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/compute/virtual-machine/tests/e2e/linux.max/dependencies.bicep b/avm/res/compute/virtual-machine/tests/e2e/linux.max/dependencies.bicep
index 3f7b866feb..b0b2b53a5a 100644
--- a/avm/res/compute/virtual-machine/tests/e2e/linux.max/dependencies.bicep
+++ b/avm/res/compute/virtual-machine/tests/e2e/linux.max/dependencies.bicep
@@ -28,12 +28,18 @@ param sshDeploymentScriptName string
 @description('Required. The name of the SSH Key to create.')
 param sshKeyName string
 
+@description('Required. The name of the data collection rule.')
+param dcrName string
+
 @description('Optional. The location to deploy to.')
 param location string = resourceGroup().location
 
 @description('Required. The object ID of the Backup Management Service Enterprise Application. Required for Customer-Managed-Keys.')
 param backupManagementServiceApplicationObjectId string
 
+@description('Required. Resource ID of the log analytics worspace to stream logs from Azure monitoring agent.')
+param logAnalyticsWorkspaceResourceId string
+
 var storageAccountCSEFileName = 'scriptExtensionMasterInstaller.ps1'
 var addressPrefix = '10.0.0.0/16'
 
@@ -315,6 +321,93 @@ resource sshKey 'Microsoft.Compute/sshPublicKeys@2022-03-01' = {
   }
 }
 
+resource dcr 'Microsoft.Insights/dataCollectionRules@2023-03-11' = {
+  name: dcrName
+  location: location
+  kind: 'Linux'
+  properties: {
+    dataSources: {
+      performanceCounters: [
+        {
+          streams: [
+            'Microsoft-Perf'
+          ]
+          samplingFrequencyInSeconds: 60
+          counterSpecifiers: [
+            '\\Processor Information(_Total)\\% Processor Time'
+            '\\Processor Information(_Total)\\% Privileged Time'
+            '\\Processor Information(_Total)\\% User Time'
+            '\\Processor Information(_Total)\\Processor Frequency'
+            '\\System\\Processes'
+            '\\Process(_Total)\\Thread Count'
+            '\\Process(_Total)\\Handle Count'
+            '\\System\\System Up Time'
+            '\\System\\Context Switches/sec'
+            '\\System\\Processor Queue Length'
+            '\\Memory\\% Committed Bytes In Use'
+            '\\Memory\\Available Bytes'
+            '\\Memory\\Committed Bytes'
+            '\\Memory\\Cache Bytes'
+            '\\Memory\\Pool Paged Bytes'
+            '\\Memory\\Pool Nonpaged Bytes'
+            '\\Memory\\Pages/sec'
+            '\\Memory\\Page Faults/sec'
+            '\\Process(_Total)\\Working Set'
+            '\\Process(_Total)\\Working Set - Private'
+            '\\LogicalDisk(_Total)\\% Disk Time'
+            '\\LogicalDisk(_Total)\\% Disk Read Time'
+            '\\LogicalDisk(_Total)\\% Disk Write Time'
+            '\\LogicalDisk(_Total)\\% Idle Time'
+            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+            '\\LogicalDisk(_Total)\\Disk Reads/sec'
+            '\\LogicalDisk(_Total)\\Disk Writes/sec'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+            '\\LogicalDisk(_Total)\\% Free Space'
+            '\\LogicalDisk(_Total)\\Free Megabytes'
+            '\\Network Interface(*)\\Bytes Total/sec'
+            '\\Network Interface(*)\\Bytes Sent/sec'
+            '\\Network Interface(*)\\Bytes Received/sec'
+            '\\Network Interface(*)\\Packets/sec'
+            '\\Network Interface(*)\\Packets Sent/sec'
+            '\\Network Interface(*)\\Packets Received/sec'
+            '\\Network Interface(*)\\Packets Outbound Errors'
+            '\\Network Interface(*)\\Packets Received Errors'
+          ]
+          name: 'perfCounterDataSource60'
+        }
+      ]
+    }
+    destinations: {
+      logAnalytics: [
+        {
+          workspaceResourceId: logAnalyticsWorkspaceResourceId
+          name: 'la--1264800308'
+        }
+      ]
+    }
+    dataFlows: [
+      {
+        streams: [
+          'Microsoft-Perf'
+        ]
+        destinations: [
+          'la--1264800308'
+        ]
+        transformKql: 'source'
+        outputStream: 'Microsoft-Perf'
+      }
+    ]
+  }
+}
+
 @description('The resource ID of the created Virtual Network Subnet.')
 output subnetResourceId string = virtualNetwork.properties.subnets[0].id
 
@@ -359,3 +452,6 @@ output storageAccountCSEFileName string = storageAccountCSEFileName
 
 @description('The Public Key of the created SSH Key.')
 output SSHKeyPublicKey string = sshKey.properties.publicKey
+
+@description('The resource ID of the created data collection rule.')
+output dataCollectionRuleResourceId string = dcr.id
diff --git a/avm/res/compute/virtual-machine/tests/e2e/linux.max/main.test.bicep b/avm/res/compute/virtual-machine/tests/e2e/linux.max/main.test.bicep
index 04ebe475d7..6b1d1a4e1e 100644
--- a/avm/res/compute/virtual-machine/tests/e2e/linux.max/main.test.bicep
+++ b/avm/res/compute/virtual-machine/tests/e2e/linux.max/main.test.bicep
@@ -20,6 +20,10 @@ param serviceShort string = 'cvmlinmax'
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The object id of the Backup Management Service Enterprise Application. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-BackupManagementServiceEnterpriseApplicationObjectId\'.')
+@secure()
+param backupManagementServiceEnterpriseApplicationObjectId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -46,7 +50,9 @@ module nestedDependencies 'dependencies.bicep' = {
     storageUploadDeploymentScriptName: 'dep-${namePrefix}-sads-${serviceShort}'
     sshDeploymentScriptName: 'dep-${namePrefix}-ds-${serviceShort}'
     sshKeyName: 'dep-${namePrefix}-ssh-${serviceShort}'
-    backupManagementServiceApplicationObjectId: '268f6a53-9f68-4a38-ae47-166f730d86af' // Tenant-specific Backup Management Service Enterprise Application Object Id
+    dcrName: 'dep-${namePrefix}-dcr-${serviceShort}'
+    backupManagementServiceApplicationObjectId: backupManagementServiceEnterpriseApplicationObjectId
+    logAnalyticsWorkspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
   }
 }
 
@@ -287,12 +293,17 @@ module testDeployment '../../../main.bicep' = {
     }
     extensionMonitoringAgentConfig: {
       enabled: true
+      dataCollectionRuleAssociations: [
+        {
+          name: 'SendMetricsToLAW'
+          dataCollectionRuleResourceId: nestedDependencies.outputs.dataCollectionRuleResourceId
+        }
+      ]
       tags: {
         'hidden-title': 'This is visible in the resource name'
         Environment: 'Non-Prod'
         Role: 'DeploymentValidation'
       }
-      monitoringWorkspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
     }
     extensionNetworkWatcherAgentConfig: {
       enabled: true
diff --git a/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/dependencies.bicep b/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/dependencies.bicep
index 6f2587a5df..795ab9dfa7 100644
--- a/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/dependencies.bicep
+++ b/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/dependencies.bicep
@@ -34,6 +34,12 @@ param location string = resourceGroup().location
 @description('Required. The object ID of the Backup Management Service Enterprise Application. Required for Customer-Managed-Keys.')
 param backupManagementServiceApplicationObjectId string
 
+@description('Required. The name of the data collection rule.')
+param dcrName string
+
+@description('Required. Resource ID of the log analytics worspace to stream logs from Azure monitoring agent.')
+param logAnalyticsWorkspaceResourceId string
+
 var storageAccountCSEFileName = 'scriptExtensionMasterInstaller.ps1'
 var addressPrefix = '10.0.0.0/16'
 
@@ -324,6 +330,93 @@ resource proximityPlacementGroup 'Microsoft.Compute/proximityPlacementGroups@202
   location: location
 }
 
+resource dcr 'Microsoft.Insights/dataCollectionRules@2023-03-11' = {
+  name: dcrName
+  location: location
+  kind: 'Windows'
+  properties: {
+    dataSources: {
+      performanceCounters: [
+        {
+          streams: [
+            'Microsoft-Perf'
+          ]
+          samplingFrequencyInSeconds: 60
+          counterSpecifiers: [
+            '\\Processor Information(_Total)\\% Processor Time'
+            '\\Processor Information(_Total)\\% Privileged Time'
+            '\\Processor Information(_Total)\\% User Time'
+            '\\Processor Information(_Total)\\Processor Frequency'
+            '\\System\\Processes'
+            '\\Process(_Total)\\Thread Count'
+            '\\Process(_Total)\\Handle Count'
+            '\\System\\System Up Time'
+            '\\System\\Context Switches/sec'
+            '\\System\\Processor Queue Length'
+            '\\Memory\\% Committed Bytes In Use'
+            '\\Memory\\Available Bytes'
+            '\\Memory\\Committed Bytes'
+            '\\Memory\\Cache Bytes'
+            '\\Memory\\Pool Paged Bytes'
+            '\\Memory\\Pool Nonpaged Bytes'
+            '\\Memory\\Pages/sec'
+            '\\Memory\\Page Faults/sec'
+            '\\Process(_Total)\\Working Set'
+            '\\Process(_Total)\\Working Set - Private'
+            '\\LogicalDisk(_Total)\\% Disk Time'
+            '\\LogicalDisk(_Total)\\% Disk Read Time'
+            '\\LogicalDisk(_Total)\\% Disk Write Time'
+            '\\LogicalDisk(_Total)\\% Idle Time'
+            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+            '\\LogicalDisk(_Total)\\Disk Reads/sec'
+            '\\LogicalDisk(_Total)\\Disk Writes/sec'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+            '\\LogicalDisk(_Total)\\% Free Space'
+            '\\LogicalDisk(_Total)\\Free Megabytes'
+            '\\Network Interface(*)\\Bytes Total/sec'
+            '\\Network Interface(*)\\Bytes Sent/sec'
+            '\\Network Interface(*)\\Bytes Received/sec'
+            '\\Network Interface(*)\\Packets/sec'
+            '\\Network Interface(*)\\Packets Sent/sec'
+            '\\Network Interface(*)\\Packets Received/sec'
+            '\\Network Interface(*)\\Packets Outbound Errors'
+            '\\Network Interface(*)\\Packets Received Errors'
+          ]
+          name: 'perfCounterDataSource60'
+        }
+      ]
+    }
+    destinations: {
+      logAnalytics: [
+        {
+          workspaceResourceId: logAnalyticsWorkspaceResourceId
+          name: 'la--1264800308'
+        }
+      ]
+    }
+    dataFlows: [
+      {
+        streams: [
+          'Microsoft-Perf'
+        ]
+        destinations: [
+          'la--1264800308'
+        ]
+        transformKql: 'source'
+        outputStream: 'Microsoft-Perf'
+      }
+    ]
+  }
+}
+
 @description('The resource ID of the created Virtual Network Subnet.')
 output subnetResourceId string = virtualNetwork.properties.subnets[0].id
 
@@ -371,3 +464,6 @@ output storageAccountCSEFileUrl string = '${storageAccount.properties.primaryEnd
 
 @description('The resource ID of the created Proximity Placement Group.')
 output proximityPlacementGroupResourceId string = proximityPlacementGroup.id
+
+@description('The resource ID of the created data collection rule.')
+output dataCollectionRuleResourceId string = dcr.id
diff --git a/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/main.test.bicep b/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/main.test.bicep
index bf307d29c7..fd619b1589 100644
--- a/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/compute/virtual-machine/tests/e2e/waf-aligned/main.test.bicep
@@ -24,6 +24,10 @@ param password string = newGuid()
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The object id of the Backup Management Service Enterprise Application. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-BackupManagementServiceEnterpriseApplicationObjectId\'.')
+@secure()
+param backupManagementServiceEnterpriseApplicationObjectId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -50,7 +54,9 @@ module nestedDependencies 'dependencies.bicep' = {
     storageAccountName: 'dep${namePrefix}sa${serviceShort}01'
     storageUploadDeploymentScriptName: 'dep-${namePrefix}-sads-${serviceShort}'
     proximityPlacementGroupName: 'dep-${namePrefix}-ppg-${serviceShort}'
-    backupManagementServiceApplicationObjectId: '268f6a53-9f68-4a38-ae47-166f730d86af' // Tenant-specific Backup Management Service Enterprise Application Object Id
+    backupManagementServiceApplicationObjectId: backupManagementServiceEnterpriseApplicationObjectId
+    dcrName: 'dep-${namePrefix}-dcr-${serviceShort}'
+    logAnalyticsWorkspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
   }
 }
 
@@ -286,6 +292,12 @@ module testDeployment '../../../main.bicep' = [
       }
       extensionMonitoringAgentConfig: {
         enabled: true
+        dataCollectionRuleAssociations: [
+          {
+            name: 'SendMetricsToLAW'
+            dataCollectionRuleResourceId: nestedDependencies.outputs.dataCollectionRuleResourceId
+          }
+        ]
         tags: {
           'hidden-title': 'This is visible in the resource name'
           Environment: 'Non-Prod'
diff --git a/avm/res/compute/virtual-machine/tests/e2e/windows.max/dependencies.bicep b/avm/res/compute/virtual-machine/tests/e2e/windows.max/dependencies.bicep
index 6f1ef21abd..a492ad2a5a 100644
--- a/avm/res/compute/virtual-machine/tests/e2e/windows.max/dependencies.bicep
+++ b/avm/res/compute/virtual-machine/tests/e2e/windows.max/dependencies.bicep
@@ -31,6 +31,12 @@ param location string = resourceGroup().location
 @description('Required. The object ID of the Backup Management Service Enterprise Application. Required for Customer-Managed-Keys.')
 param backupManagementServiceApplicationObjectId string
 
+@description('Required. The name of the data collection rule.')
+param dcrName string
+
+@description('Required. Resource ID of the log analytics worspace to stream logs from Azure monitoring agent.')
+param logAnalyticsWorkspaceResourceId string
+
 var storageAccountCSEFileName = 'scriptExtensionMasterInstaller.ps1'
 var addressPrefix = '10.0.0.0/16'
 
@@ -288,6 +294,92 @@ resource proximityPlacementGroup 'Microsoft.Compute/proximityPlacementGroups@202
   location: location
 }
 
+resource dcr 'Microsoft.Insights/dataCollectionRules@2023-03-11' = {
+  name: dcrName
+  location: location
+  kind: 'Windows'
+  properties: {
+    dataSources: {
+      performanceCounters: [
+        {
+          streams: [
+            'Microsoft-Perf'
+          ]
+          samplingFrequencyInSeconds: 60
+          counterSpecifiers: [
+            '\\Processor Information(_Total)\\% Processor Time'
+            '\\Processor Information(_Total)\\% Privileged Time'
+            '\\Processor Information(_Total)\\% User Time'
+            '\\Processor Information(_Total)\\Processor Frequency'
+            '\\System\\Processes'
+            '\\Process(_Total)\\Thread Count'
+            '\\Process(_Total)\\Handle Count'
+            '\\System\\System Up Time'
+            '\\System\\Context Switches/sec'
+            '\\System\\Processor Queue Length'
+            '\\Memory\\% Committed Bytes In Use'
+            '\\Memory\\Available Bytes'
+            '\\Memory\\Committed Bytes'
+            '\\Memory\\Cache Bytes'
+            '\\Memory\\Pool Paged Bytes'
+            '\\Memory\\Pool Nonpaged Bytes'
+            '\\Memory\\Pages/sec'
+            '\\Memory\\Page Faults/sec'
+            '\\Process(_Total)\\Working Set'
+            '\\Process(_Total)\\Working Set - Private'
+            '\\LogicalDisk(_Total)\\% Disk Time'
+            '\\LogicalDisk(_Total)\\% Disk Read Time'
+            '\\LogicalDisk(_Total)\\% Disk Write Time'
+            '\\LogicalDisk(_Total)\\% Idle Time'
+            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+            '\\LogicalDisk(_Total)\\Disk Reads/sec'
+            '\\LogicalDisk(_Total)\\Disk Writes/sec'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+            '\\LogicalDisk(_Total)\\% Free Space'
+            '\\LogicalDisk(_Total)\\Free Megabytes'
+            '\\Network Interface(*)\\Bytes Total/sec'
+            '\\Network Interface(*)\\Bytes Sent/sec'
+            '\\Network Interface(*)\\Bytes Received/sec'
+            '\\Network Interface(*)\\Packets/sec'
+            '\\Network Interface(*)\\Packets Sent/sec'
+            '\\Network Interface(*)\\Packets Received/sec'
+            '\\Network Interface(*)\\Packets Outbound Errors'
+            '\\Network Interface(*)\\Packets Received Errors'
+          ]
+          name: 'perfCounterDataSource60'
+        }
+      ]
+    }
+    destinations: {
+      logAnalytics: [
+        {
+          workspaceResourceId: logAnalyticsWorkspaceResourceId
+          name: 'la--1264800308'
+        }
+      ]
+    }
+    dataFlows: [
+      {
+        streams: [
+          'Microsoft-Perf'
+        ]
+        destinations: [
+          'la--1264800308'
+        ]
+        transformKql: 'source'
+        outputStream: 'Microsoft-Perf'
+      }
+    ]
+  }
+}
 @description('The resource ID of the created Virtual Network Subnet.')
 output subnetResourceId string = virtualNetwork.properties.subnets[0].id
 
@@ -332,3 +424,6 @@ output storageAccountCSEFileUrl string = '${storageAccount.properties.primaryEnd
 
 @description('The resource ID of the created Proximity Placement Group.')
 output proximityPlacementGroupResourceId string = proximityPlacementGroup.id
+
+@description('The resource ID of the created data collection rule.')
+output dataCollectionRuleResourceId string = dcr.id
diff --git a/avm/res/compute/virtual-machine/tests/e2e/windows.max/main.test.bicep b/avm/res/compute/virtual-machine/tests/e2e/windows.max/main.test.bicep
index 9c4be82965..ac79b215ce 100644
--- a/avm/res/compute/virtual-machine/tests/e2e/windows.max/main.test.bicep
+++ b/avm/res/compute/virtual-machine/tests/e2e/windows.max/main.test.bicep
@@ -24,6 +24,10 @@ param password string = newGuid()
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The object id of the Backup Management Service Enterprise Application. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-BackupManagementServiceEnterpriseApplicationObjectId\'.')
+@secure()
+param backupManagementServiceEnterpriseApplicationObjectId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -49,7 +53,9 @@ module nestedDependencies 'dependencies.bicep' = {
     storageAccountName: 'dep${namePrefix}sa${serviceShort}01'
     storageUploadDeploymentScriptName: 'dep-${namePrefix}-sads-${serviceShort}'
     proximityPlacementGroupName: 'dep-${namePrefix}-ppg-${serviceShort}'
-    backupManagementServiceApplicationObjectId: '268f6a53-9f68-4a38-ae47-166f730d86af' // Tenant-specific Backup Management Service Enterprise Application Object Id
+    backupManagementServiceApplicationObjectId: backupManagementServiceEnterpriseApplicationObjectId
+    dcrName: 'dep-${namePrefix}-dcr-${serviceShort}'
+    logAnalyticsWorkspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
   }
 }
 
@@ -327,12 +333,17 @@ module testDeployment '../../../main.bicep' = [
       }
       extensionMonitoringAgentConfig: {
         enabled: true
+        dataCollectionRuleAssociations: [
+          {
+            name: 'SendMetricsToLAW'
+            dataCollectionRuleResourceId: nestedDependencies.outputs.dataCollectionRuleResourceId
+          }
+        ]
         tags: {
           'hidden-title': 'This is visible in the resource name'
           Environment: 'Non-Prod'
           Role: 'DeploymentValidation'
         }
-        monitoringWorkspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
       }
       extensionNetworkWatcherAgentConfig: {
         enabled: true
diff --git a/avm/res/consumption/budget/README.md b/avm/res/consumption/budget/README.md
index bf2f6b644a..53638a6f17 100644
--- a/avm/res/consumption/budget/README.md
+++ b/avm/res/consumption/budget/README.md
@@ -25,8 +25,9 @@ The following section provides usage examples for the module, which were used to
 >**Note**: To reference the module, please use the following syntax `br/public:avm/res/consumption/budget:<version>`.
 
 - [Using only defaults](#example-1-using-only-defaults)
-- [Using large parameter set](#example-2-using-large-parameter-set)
-- [WAF-aligned](#example-3-waf-aligned)
+- [Using `thresholdType` `Forecasted`](#example-2-using-thresholdtype-forecasted)
+- [Using large parameter set](#example-3-using-large-parameter-set)
+- [WAF-aligned](#example-4-waf-aligned)
 
 ### Example 1: _Using only defaults_
 
@@ -88,7 +89,71 @@ module budget 'br/public:avm/res/consumption/budget:<version>' = {
 </details>
 <p>
 
-### Example 2: _Using large parameter set_
+### Example 2: _Using `thresholdType` `Forecasted`_
+
+This instance deploys the module with the minimum set of required parameters and `thresholdType` `Forecasted`.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module budget 'br/public:avm/res/consumption/budget:<version>' = {
+  name: 'budgetDeployment'
+  params: {
+    // Required parameters
+    amount: 500
+    name: 'cbfcst001'
+    // Non-required parameters
+    contactEmails: [
+      'dummy@contoso.com'
+    ]
+    location: '<location>'
+    thresholdType: 'Forecasted'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "amount": {
+      "value": 500
+    },
+    "name": {
+      "value": "cbfcst001"
+    },
+    // Non-required parameters
+    "contactEmails": {
+      "value": [
+        "dummy@contoso.com"
+      ]
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "thresholdType": {
+      "value": "Forecasted"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 3: _Using large parameter set_
 
 This instance deploys the module with most of its features enabled.
 
@@ -174,7 +239,7 @@ module budget 'br/public:avm/res/consumption/budget:<version>' = {
 </details>
 <p>
 
-### Example 3: _WAF-aligned_
+### Example 4: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
diff --git a/avm/res/consumption/budget/main.json b/avm/res/consumption/budget/main.json
index d51817dbd2..b68ced8a2d 100644
--- a/avm/res/consumption/budget/main.json
+++ b/avm/res/consumption/budget/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "13231547958069431465"
+      "version": "0.29.47.4906",
+      "templateHash": "9899827298268482806"
     },
     "name": "Consumption Budgets",
     "description": "This module deploys a Consumption Budget for Subscriptions.",
diff --git a/avm/res/consumption/budget/tests/e2e/forecasted/main.test.bicep b/avm/res/consumption/budget/tests/e2e/forecasted/main.test.bicep
new file mode 100644
index 0000000000..91112be1f4
--- /dev/null
+++ b/avm/res/consumption/budget/tests/e2e/forecasted/main.test.bicep
@@ -0,0 +1,37 @@
+targetScope = 'subscription'
+
+metadata name = 'Using `thresholdType` `Forecasted`'
+metadata description = 'This instance deploys the module with the minimum set of required parameters and `thresholdType` `Forecasted`.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'cbfcst'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    name: '${uniqueString(deployment().name)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      amount: 500
+      contactEmails: [
+        'dummy@contoso.com'
+      ]
+      thresholdType: 'Forecasted'
+    }
+  }
+]
diff --git a/avm/res/container-instance/container-group/README.md b/avm/res/container-instance/container-group/README.md
index 4f607cd39d..e34bffb713 100644
--- a/avm/res/container-instance/container-group/README.md
+++ b/avm/res/container-instance/container-group/README.md
@@ -205,7 +205,7 @@ module containerGroup 'br/public:avm/res/container-instance/container-group:<ver
         protocol: 'Tcp'
       }
     ]
-    name: 'cicgenc001'
+    name: 'cicgencr001'
     // Non-required parameters
     customerManagedKey: {
       keyName: '<keyName>'
@@ -301,7 +301,7 @@ module containerGroup 'br/public:avm/res/container-instance/container-group:<ver
       ]
     },
     "name": {
-      "value": "cicgenc001"
+      "value": "cicgencr001"
     },
     // Non-required parameters
     "customerManagedKey": {
diff --git a/avm/res/container-instance/container-group/tests/e2e/encr/main.test.bicep b/avm/res/container-instance/container-group/tests/e2e/encr/main.test.bicep
index d3d32ff86b..2d4ff93aa3 100644
--- a/avm/res/container-instance/container-group/tests/e2e/encr/main.test.bicep
+++ b/avm/res/container-instance/container-group/tests/e2e/encr/main.test.bicep
@@ -15,7 +15,7 @@ param resourceGroupName string = 'dep-${namePrefix}-containerinstance.containerg
 param resourceLocation string = deployment().location
 
 @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
-param serviceShort string = 'cicgenc'
+param serviceShort string = 'cicgencr'
 
 @description('Generated. Used as a basis for unique resource names.')
 param baseTime string = utcNow('u')
diff --git a/avm/res/data-factory/factory/README.md b/avm/res/data-factory/factory/README.md
index 433b7f2fb8..d4ee7144b0 100644
--- a/avm/res/data-factory/factory/README.md
+++ b/avm/res/data-factory/factory/README.md
@@ -193,9 +193,13 @@ module factory 'br/public:avm/res/data-factory/factory:<version>' = {
     managedVirtualNetworkName: 'default'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           application: 'AVM'
@@ -203,9 +207,13 @@ module factory 'br/public:avm/res/data-factory/factory:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -367,9 +375,13 @@ module factory 'br/public:avm/res/data-factory/factory:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "application": "AVM",
@@ -377,9 +389,13 @@ module factory 'br/public:avm/res/data-factory/factory:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -991,8 +1007,7 @@ Configuration Details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1176,19 +1191,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1441,8 +1501,9 @@ Tags of the resource.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The Name of the Azure Data Factory instance. |
+| `privateEndpoints` | array | The private endpoints of the Data Factory. |
 | `resourceGroupName` | string | The name of the Resource Group with the Data factory. |
-| `resourceId` | string | The Resource ID of the Data factory. |
+| `resourceId` | string | The Resource ID of the Data Factory. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
 
 ## Cross-referenced modules
@@ -1451,7 +1512,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/data-factory/factory/main.bicep b/avm/res/data-factory/factory/main.bicep
index 1ad4dcfe76..bf2a338511 100644
--- a/avm/res/data-factory/factory/main.bicep
+++ b/avm/res/data-factory/factory/main.bicep
@@ -318,7 +318,7 @@ resource dataFactory_roleAssignments 'Microsoft.Authorization/roleAssignments@20
   }
 ]
 
-module dataFactory_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module dataFactory_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-dataFactory-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -359,8 +359,7 @@ module dataFactory_privateEndpoints 'br/public:avm/res/network/private-endpoint:
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -374,7 +373,7 @@ module dataFactory_privateEndpoints 'br/public:avm/res/network/private-endpoint:
 @description('The Name of the Azure Data Factory instance.')
 output name string = dataFactory.name
 
-@description('The Resource ID of the Data factory.')
+@description('The Resource ID of the Data Factory.')
 output resourceId string = dataFactory.id
 
 @description('The name of the Resource Group with the Data factory.')
@@ -386,6 +385,17 @@ output systemAssignedMIPrincipalId string = dataFactory.?identity.?principalId ?
 @description('The location the resource was deployed into.')
 output location string = dataFactory.location
 
+@description('The private endpoints of the Data Factory.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: dataFactory_privateEndpoints[i].outputs.name
+    resourceId: dataFactory_privateEndpoints[i].outputs.resourceId
+    groupId: dataFactory_privateEndpoints[i].outputs.groupId
+    customDnsConfig: dataFactory_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: dataFactory_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -448,11 +458,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/data-factory/factory/main.json b/avm/res/data-factory/factory/main.json
index feea01d445..74ba78d45e 100644
--- a/avm/res/data-factory/factory/main.json
+++ b/avm/res/data-factory/factory/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "5481550023374339026"
+      "templateHash": "577014275789719005"
     },
     "name": "Data Factories",
     "description": "This module deploys a Data Factory.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -1356,11 +1379,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1389,13 +1409,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1647,6 +1688,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1682,18 +1746,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1774,7 +1831,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1853,7 +1910,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1864,28 +1921,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1893,12 +1974,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1912,27 +1996,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1999,6 +2092,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2025,7 +2125,7 @@
     "resourceId": {
       "type": "string",
       "metadata": {
-        "description": "The Resource ID of the Data factory."
+        "description": "The Resource ID of the Data Factory."
       },
       "value": "[resourceId('Microsoft.DataFactory/factories', parameters('name'))]"
     },
@@ -2049,6 +2149,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('dataFactory', '2018-06-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Data Factory."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('dataFactory_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('dataFactory_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('dataFactory_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('dataFactory_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('dataFactory_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/data-factory/factory/tests/e2e/max/main.test.bicep b/avm/res/data-factory/factory/tests/e2e/max/main.test.bicep
index f696b62d15..03a1f38a74 100644
--- a/avm/res/data-factory/factory/tests/e2e/max/main.test.bicep
+++ b/avm/res/data-factory/factory/tests/e2e/max/main.test.bicep
@@ -157,9 +157,13 @@ module testDeployment '../../../main.bicep' = [
       managedVirtualNetworkName: 'default'
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -167,9 +171,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/data-factory/factory/version.json b/avm/res/data-factory/factory/version.json
index 3f863a2bec..a8eda31021 100644
--- a/avm/res/data-factory/factory/version.json
+++ b/avm/res/data-factory/factory/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.4",
+    "version": "0.5",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/databricks/workspace/README.md b/avm/res/databricks/workspace/README.md
index ea1235364d..6ee2ca03c2 100644
--- a/avm/res/databricks/workspace/README.md
+++ b/avm/res/databricks/workspace/README.md
@@ -142,9 +142,13 @@ module workspace 'br/public:avm/res/databricks/workspace:<version>' = {
     prepareEncryption: true
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'databricks_ui_api'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -153,9 +157,13 @@ module workspace 'br/public:avm/res/databricks/workspace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'browser_authentication'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -287,9 +295,13 @@ module workspace 'br/public:avm/res/databricks/workspace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "databricks_ui_api",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -298,9 +310,13 @@ module workspace 'br/public:avm/res/databricks/workspace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "browser_authentication",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -445,9 +461,13 @@ module workspace 'br/public:avm/res/databricks/workspace:<version>' = {
     storageAccountName: 'sadwwaf001'
     storageAccountPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<blobStoragePrivateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -597,9 +617,13 @@ module workspace 'br/public:avm/res/databricks/workspace:<version>' = {
     "storageAccountPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<blobStoragePrivateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -1070,8 +1094,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1261,19 +1284,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1604,8 +1672,7 @@ Configuration details for private endpoints for the managed workspace storage ac
 | [`lock`](#parameter-storageaccountprivateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-storageaccountprivateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-storageaccountprivateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-storageaccountprivateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-storageaccountprivateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-storageaccountprivateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-storageaccountprivateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-storageaccountprivateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-storageaccountprivateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1795,19 +1862,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneGroupName`
+### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-storageaccountprivateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-storageaccountprivateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-storageaccountprivateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-storageaccountprivateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `storageAccountPrivateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `storageAccountPrivateEndpoints.privateLinkServiceConnectionName`
 
@@ -1958,11 +2070,12 @@ Address prefix for Managed virtual network.
 | `managedResourceGroupId` | string | The resource ID of the managed resource group. |
 | `managedResourceGroupName` | string | The name of the managed resource group. |
 | `name` | string | The name of the deployed databricks workspace. |
-| `privateEndpoints` | array | The private endpoints for the Databricks Workspace. |
+| `privateEndpoints` | array | The private endpoints of the Databricks Workspace. |
 | `resourceGroupName` | string | The resource group of the deployed databricks workspace. |
 | `resourceId` | string | The resource ID of the deployed databricks workspace. |
 | `storageAccountId` | string | The resource ID of the DBFS storage account. |
 | `storageAccountName` | string | The name of the DBFS storage account. |
+| `storagePrivateEndpoints` | array | The private endpoints of the Databricks Workspace Storage. |
 | `workspaceId` | string | The unique identifier of the databricks workspace in databricks control plane. |
 | `workspaceUrl` | string | The workspace URL which is of the format 'adb-{workspaceId}.{random}.azuredatabricks.net'. |
 
@@ -1972,7 +2085,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/databricks/workspace/main.bicep b/avm/res/databricks/workspace/main.bicep
index 979da5ba00..a0d1bd4b59 100644
--- a/avm/res/databricks/workspace/main.bicep
+++ b/avm/res/databricks/workspace/main.bicep
@@ -383,7 +383,7 @@ resource workspace_roleAssignments 'Microsoft.Authorization/roleAssignments@2022
 ]
 
 @batchSize(1)
-module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-workspace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -424,8 +424,7 @@ module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -445,7 +444,7 @@ var _storageAccountId = resourceId(
 )
 
 @batchSize(1)
-module storageAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module storageAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (storageAccountPrivateEndpoints ?? []): if (privateStorageAccount == 'Enabled') {
     name: '${uniqueString(deployment().name, location)}-workspacestorage-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -486,8 +485,7 @@ module storageAccount_privateEndpoints 'br/public:avm/res/network/private-endpoi
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -528,11 +526,27 @@ output workspaceUrl string = workspace.properties.workspaceUrl
 @description('The unique identifier of the databricks workspace in databricks control plane.')
 output workspaceId string = workspace.properties.workspaceId
 
-@description('The private endpoints for the Databricks Workspace.')
+@description('The private endpoints of the Databricks Workspace.')
 output privateEndpoints array = [
   for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
     name: workspace_privateEndpoints[i].outputs.name
     resourceId: workspace_privateEndpoints[i].outputs.resourceId
+    groupId: workspace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: workspace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: workspace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('The private endpoints of the Databricks Workspace Storage.')
+output storagePrivateEndpoints array = [
+  for (pe, i) in ((!empty(storageAccountPrivateEndpoints) && privateStorageAccount == 'Enabled')
+    ? array(storageAccountPrivateEndpoints)
+    : []): {
+    name: storageAccount_privateEndpoints[i].outputs.name
+    resourceId: storageAccount_privateEndpoints[i].outputs.resourceId
+    groupId: storageAccount_privateEndpoints[i].outputs.groupId
+    customDnsConfig: storageAccount_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: storageAccount_privateEndpoints[i].outputs.networkInterfaceIds
   }
 ]
 
@@ -564,11 +578,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/databricks/workspace/main.json b/avm/res/databricks/workspace/main.json
index 44cb34f1cd..b30f600d96 100644
--- a/avm/res/databricks/workspace/main.json
+++ b/avm/res/databricks/workspace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13391161976457679542"
+      "templateHash": "13865252037974484038"
     },
     "name": "Azure Databricks Workspaces",
     "description": "This module deploys an Azure Databricks Workspace.",
@@ -76,21 +76,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -899,11 +922,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -932,13 +952,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1190,6 +1231,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1225,18 +1289,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1317,7 +1374,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1396,7 +1453,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1407,28 +1464,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1436,12 +1517,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1455,27 +1539,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1542,6 +1635,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1591,11 +1691,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('storageAccountPrivateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('storageAccountPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('storageAccountPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('storageAccountPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('storageAccountPrivateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1624,13 +1721,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1882,6 +2000,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1917,18 +2058,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2009,7 +2143,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2088,7 +2222,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2099,28 +2233,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2128,12 +2286,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2147,27 +2308,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2234,6 +2404,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2323,13 +2500,32 @@
     "privateEndpoints": {
       "type": "array",
       "metadata": {
-        "description": "The private endpoints for the Databricks Workspace."
+        "description": "The private endpoints of the Databricks Workspace."
       },
       "copy": {
         "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
         "input": {
           "name": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-          "resourceId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]"
+          "resourceId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "storagePrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Databricks Workspace Storage."
+      },
+      "copy": {
+        "count": "[length(if(and(not(empty(parameters('storageAccountPrivateEndpoints'))), equals(parameters('privateStorageAccount'), 'Enabled')), array(parameters('storageAccountPrivateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
         }
       }
     }
diff --git a/avm/res/databricks/workspace/tests/e2e/max/main.test.bicep b/avm/res/databricks/workspace/tests/e2e/max/main.test.bicep
index da9e093759..b1745bfe1d 100644
--- a/avm/res/databricks/workspace/tests/e2e/max/main.test.bicep
+++ b/avm/res/databricks/workspace/tests/e2e/max/main.test.bicep
@@ -23,6 +23,10 @@ param baseTime string = utcNow('u')
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The object id of the AzureDatabricks Enterprise Application. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-AzureDatabricksEnterpriseApplicationObjectId\'.')
+@secure()
+param azureDatabricksEnterpriseApplicationObjectId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -47,7 +51,7 @@ module nestedDependencies 'dependencies.bicep' = {
     storageAccountName: 'dep${namePrefix}sa${serviceShort}'
     virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
     networkSecurityGroupName: 'dep-${namePrefix}-nsg-${serviceShort}'
-    databricksApplicationObjectId: '711330f9-cfad-4b10-a462-d82faa92027d' // Tenant-specific 'AzureDatabricks' Enterprise Application Object Id
+    databricksApplicationObjectId: azureDatabricksEnterpriseApplicationObjectId
     keyVaultDiskName: 'dep-${namePrefix}-kve-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}'
     // Adding base time to make the name unique as purge protection must be enabled (but may not be longer than 24 characters total)
     keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}'
@@ -154,9 +158,13 @@ module testDeployment '../../../main.bicep' = [
       customVirtualNetworkResourceId: nestedDependencies.outputs.virtualNetworkResourceId
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'databricks_ui_api'
           subnetResourceId: nestedDependencies.outputs.primarySubnetResourceId
           tags: {
@@ -165,9 +173,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.secondarySubnetResourceId
           service: 'browser_authentication'
         }
diff --git a/avm/res/databricks/workspace/tests/e2e/waf-aligned/main.test.bicep b/avm/res/databricks/workspace/tests/e2e/waf-aligned/main.test.bicep
index 5211c6b795..1602f41f85 100644
--- a/avm/res/databricks/workspace/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/databricks/workspace/tests/e2e/waf-aligned/main.test.bicep
@@ -23,6 +23,10 @@ param baseTime string = utcNow('u')
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The object id of the AzureDatabricks Enterprise Application. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-AzureDatabricksEnterpriseApplicationObjectId\'.')
+@secure()
+param azureDatabricksEnterpriseApplicationObjectId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -47,7 +51,7 @@ module nestedDependencies 'dependencies.bicep' = {
     storageAccountName: 'dep${namePrefix}sa${serviceShort}'
     virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
     networkSecurityGroupName: 'dep-${namePrefix}-nsg-${serviceShort}'
-    databricksApplicationObjectId: '711330f9-cfad-4b10-a462-d82faa92027d' // Tenant-specific 'AzureDatabricks' Enterprise Application Object Id
+    databricksApplicationObjectId: azureDatabricksEnterpriseApplicationObjectId
     keyVaultDiskName: 'dep-${namePrefix}-kve-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}'
     // Adding base time to make the name unique as purge protection must be enabled (but may not be longer than 24 characters total)
     keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}'
@@ -152,9 +156,13 @@ module testDeployment '../../../main.bicep' = [
       accessConnectorResourceId: nestedDependencies.outputs.accessConnectorResourceId
       storageAccountPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.blobStoragePrivateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.blobStoragePrivateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.defaultSubnetResourceId
           tags: {
diff --git a/avm/res/databricks/workspace/version.json b/avm/res/databricks/workspace/version.json
index e42c3d9e5f..7e1d3f4157 100644
--- a/avm/res/databricks/workspace/version.json
+++ b/avm/res/databricks/workspace/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.6",
+    "version": "0.7",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/db-for-my-sql/flexible-server/README.md b/avm/res/db-for-my-sql/flexible-server/README.md
index 8176adfb71..f915bedd9d 100644
--- a/avm/res/db-for-my-sql/flexible-server/README.md
+++ b/avm/res/db-for-my-sql/flexible-server/README.md
@@ -177,7 +177,7 @@ module flexibleServer 'br/public:avm/res/db-for-my-sql/flexible-server:<version>
       }
     ]
     geoRedundantBackup: 'Enabled'
-    highAvailability: 'SameZone'
+    highAvailability: 'ZoneRedundant'
     location: '<location>'
     lock: {
       kind: 'CanNotDelete'
@@ -322,7 +322,7 @@ module flexibleServer 'br/public:avm/res/db-for-my-sql/flexible-server:<version>
       "value": "Enabled"
     },
     "highAvailability": {
-      "value": "SameZone"
+      "value": "ZoneRedundant"
     },
     "location": {
       "value": "<location>"
diff --git a/avm/res/db-for-my-sql/flexible-server/main.json b/avm/res/db-for-my-sql/flexible-server/main.json
index be16a52fcc..ce118494a1 100644
--- a/avm/res/db-for-my-sql/flexible-server/main.json
+++ b/avm/res/db-for-my-sql/flexible-server/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "13929385437976763418"
+      "version": "0.29.47.4906",
+      "templateHash": "12125422157581852477"
     },
     "name": "DBforMySQL Flexible Servers",
     "description": "This module deploys a DBforMySQL Flexible Server.",
diff --git a/avm/res/db-for-my-sql/flexible-server/tests/e2e/max/main.test.bicep b/avm/res/db-for-my-sql/flexible-server/tests/e2e/max/main.test.bicep
index 34a88c3a37..0255def79e 100644
--- a/avm/res/db-for-my-sql/flexible-server/tests/e2e/max/main.test.bicep
+++ b/avm/res/db-for-my-sql/flexible-server/tests/e2e/max/main.test.bicep
@@ -157,7 +157,7 @@ module testDeployment '../../../main.bicep' = [
           startIpAddress: '100.100.100.1'
         }
       ]
-      highAvailability: 'SameZone'
+      highAvailability: 'ZoneRedundant'
       storageAutoGrow: 'Enabled'
       version: '8.0.21'
       customerManagedKey: {
diff --git a/avm/res/db-for-postgre-sql/flexible-server/README.md b/avm/res/db-for-postgre-sql/flexible-server/README.md
index c76dac7343..8e84071338 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/README.md
+++ b/avm/res/db-for-postgre-sql/flexible-server/README.md
@@ -52,12 +52,18 @@ module flexibleServer 'br/public:avm/res/db-for-postgre-sql/flexible-server:<ver
   params: {
     // Required parameters
     name: 'dfpsfsmin001'
-    skuName: 'Standard_B2s'
-    tier: 'Burstable'
+    skuName: 'Standard_D2s_v3'
+    tier: 'GeneralPurpose'
     // Non-required parameters
-    administratorLogin: 'adminUserName'
-    administratorLoginPassword: '<administratorLoginPassword>'
+    administrators: [
+      {
+        objectId: '<objectId>'
+        principalName: '<principalName>'
+        principalType: 'ServicePrincipal'
+      }
+    ]
     geoRedundantBackup: 'Enabled'
+    highAvailability: 'ZoneRedundant'
     location: '<location>'
   }
 }
@@ -80,21 +86,27 @@ module flexibleServer 'br/public:avm/res/db-for-postgre-sql/flexible-server:<ver
       "value": "dfpsfsmin001"
     },
     "skuName": {
-      "value": "Standard_B2s"
+      "value": "Standard_D2s_v3"
     },
     "tier": {
-      "value": "Burstable"
+      "value": "GeneralPurpose"
     },
     // Non-required parameters
-    "administratorLogin": {
-      "value": "adminUserName"
-    },
-    "administratorLoginPassword": {
-      "value": "<administratorLoginPassword>"
+    "administrators": {
+      "value": [
+        {
+          "objectId": "<objectId>",
+          "principalName": "<principalName>",
+          "principalType": "ServicePrincipal"
+        }
+      ]
     },
     "geoRedundantBackup": {
       "value": "Enabled"
     },
+    "highAvailability": {
+      "value": "ZoneRedundant"
+    },
     "location": {
       "value": "<location>"
     }
@@ -696,7 +708,14 @@ module flexibleServer 'br/public:avm/res/db-for-postgre-sql/flexible-server:<ver
       }
     ]
     geoRedundantBackup: 'Enabled'
+    highAvailability: 'ZoneRedundant'
     location: '<location>'
+    maintenanceWindow: {
+      customWindow: 'Enabled'
+      dayOfWeek: 0
+      startHour: 1
+      startMinute: 0
+    }
     privateDnsZoneArmResourceId: '<privateDnsZoneArmResourceId>'
     tags: {
       Environment: 'Non-Prod'
@@ -781,9 +800,20 @@ module flexibleServer 'br/public:avm/res/db-for-postgre-sql/flexible-server:<ver
     "geoRedundantBackup": {
       "value": "Enabled"
     },
+    "highAvailability": {
+      "value": "ZoneRedundant"
+    },
     "location": {
       "value": "<location>"
     },
+    "maintenanceWindow": {
+      "value": {
+        "customWindow": "Enabled",
+        "dayOfWeek": 0,
+        "startHour": 1,
+        "startMinute": 0
+      }
+    },
     "privateDnsZoneArmResourceId": {
       "value": "<privateDnsZoneArmResourceId>"
     },
@@ -1252,7 +1282,7 @@ The mode for high availability.
 
 - Required: No
 - Type: string
-- Default: `'Disabled'`
+- Default: `'ZoneRedundant'`
 - Allowed:
   ```Bicep
   [
@@ -1312,7 +1342,15 @@ Properties for the maintenence window. If provided, 'customWindow' property must
 
 - Required: No
 - Type: object
-- Default: `{}`
+- Default:
+  ```Bicep
+  {
+      customWindow: 'Enabled'
+      dayOfWeek: 0
+      startHour: 1
+      startMinute: 0
+  }
+  ```
 
 ### Parameter: `passwordAuth`
 
@@ -1359,6 +1397,7 @@ Array of role assignments to create.
 | [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
 | [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
 | [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
+| [`name`](#parameter-roleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
 | [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
 
 ### Parameter: `roleAssignments.principalId`
@@ -1409,6 +1448,13 @@ The description of the role assignment.
 - Required: No
 - Type: string
 
+### Parameter: `roleAssignments.name`
+
+The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+
+- Required: No
+- Type: string
+
 ### Parameter: `roleAssignments.principalType`
 
 The principal type of the assigned principal ID.
@@ -1470,7 +1516,7 @@ PostgreSQL Server version.
 
 - Required: No
 - Type: string
-- Default: `'15'`
+- Default: `'16'`
 - Allowed:
   ```Bicep
   [
@@ -1479,6 +1525,7 @@ PostgreSQL Server version.
     '13'
     '14'
     '15'
+    '16'
   ]
   ```
 
diff --git a/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json b/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json
index 69197e9646..b7337b4766 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json
+++ b/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.26.170.59819",
-      "templateHash": "17302939650459446486"
+      "version": "0.29.47.4906",
+      "templateHash": "9786947819042824705"
     },
     "name": "DBforPostgreSQL Flexible Server Administrators",
     "description": "This module deploys a DBforPostgreSQL Flexible Server Administrator.",
diff --git a/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json b/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json
index 82ff31c783..8903e9ef21 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json
+++ b/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.26.170.59819",
-      "templateHash": "4808844582468160626"
+      "version": "0.29.47.4906",
+      "templateHash": "3802666632340288344"
     },
     "name": "DBforPostgreSQL Flexible Server Configurations",
     "description": "This module deploys a DBforPostgreSQL Flexible Server Configuration.",
diff --git a/avm/res/db-for-postgre-sql/flexible-server/database/main.json b/avm/res/db-for-postgre-sql/flexible-server/database/main.json
index a628aabe2a..1b15b5c7a4 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/database/main.json
+++ b/avm/res/db-for-postgre-sql/flexible-server/database/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.26.170.59819",
-      "templateHash": "12256776332622303948"
+      "version": "0.29.47.4906",
+      "templateHash": "17501165975344742322"
     },
     "name": "DBforPostgreSQL Flexible Server Databases",
     "description": "This module deploys a DBforPostgreSQL Flexible Server Database.",
diff --git a/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json b/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json
index b7c6ec5209..572f886bfe 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json
+++ b/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.26.170.59819",
-      "templateHash": "12309357869547394167"
+      "version": "0.29.47.4906",
+      "templateHash": "5110779562094536429"
     },
     "name": "DBforPostgreSQL Flexible Server Firewall Rules",
     "description": "This module deploys a DBforPostgreSQL Flexible Server Firewall Rule.",
diff --git a/avm/res/db-for-postgre-sql/flexible-server/main.bicep b/avm/res/db-for-postgre-sql/flexible-server/main.bicep
index 58f76dcdfe..24a84a31e8 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/main.bicep
+++ b/avm/res/db-for-postgre-sql/flexible-server/main.bicep
@@ -89,9 +89,10 @@ param storageSizeGB int = 32
   '13'
   '14'
   '15'
+  '16'
 ])
 @description('Optional. PostgreSQL Server version.')
-param version string = '15'
+param version string = '16'
 
 @allowed([
   'Disabled'
@@ -99,7 +100,7 @@ param version string = '15'
   'ZoneRedundant'
 ])
 @description('Optional. The mode for high availability.')
-param highAvailability string = 'Disabled'
+param highAvailability string = 'ZoneRedundant'
 
 @allowed([
   'Create'
@@ -117,7 +118,12 @@ param managedIdentities managedIdentitiesType
 param customerManagedKey customerManagedKeyType
 
 @description('Optional. Properties for the maintenence window. If provided, \'customWindow\' property must exist and set to \'Enabled\'.')
-param maintenanceWindow object = {}
+param maintenanceWindow object = {
+  customWindow: 'Enabled'
+  dayOfWeek: 0
+  startHour: 1
+  startMinute: 0
+}
 
 @description('Conditional. Required if \'createMode\' is set to \'PointInTimeRestore\'.')
 param pointInTimeUTC string = ''
@@ -182,6 +188,17 @@ var builtInRoleNames = {
   )
 }
 
+var formattedRoleAssignments = [
+  for (roleAssignment, index) in (roleAssignments ?? []): union(roleAssignment, {
+    roleDefinitionId: builtInRoleNames[?roleAssignment.roleDefinitionIdOrName] ?? (contains(
+        roleAssignment.roleDefinitionIdOrName,
+        '/providers/Microsoft.Authorization/roleDefinitions/'
+      )
+      ? roleAssignment.roleDefinitionIdOrName
+      : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName))
+  })
+]
+
 #disable-next-line no-deployments-resources
 resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
   name: '46d3xbcp.res.dbforpostgresql-flexibleserver.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
@@ -292,14 +309,10 @@ resource flexibleServer_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!e
 }
 
 resource flexibleServer_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
-  for (roleAssignment, index) in (roleAssignments ?? []): {
-    name: guid(flexibleServer.id, roleAssignment.principalId, roleAssignment.roleDefinitionIdOrName)
+  for (roleAssignment, index) in (formattedRoleAssignments ?? []): {
+    name: roleAssignment.?name ?? guid(flexibleServer.id, roleAssignment.principalId, roleAssignment.roleDefinitionId)
     properties: {
-      roleDefinitionId: contains(builtInRoleNames, roleAssignment.roleDefinitionIdOrName)
-        ? builtInRoleNames[roleAssignment.roleDefinitionIdOrName]
-        : contains(roleAssignment.roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/')
-            ? roleAssignment.roleDefinitionIdOrName
-            : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName)
+      roleDefinitionId: roleAssignment.roleDefinitionId
       principalId: roleAssignment.principalId
       description: roleAssignment.?description
       principalType: roleAssignment.?principalType
@@ -317,8 +330,8 @@ module flexibleServer_databases 'database/main.bicep' = [
     params: {
       name: database.name
       flexibleServerName: flexibleServer.name
-      collation: contains(database, 'collation') ? database.collation : ''
-      charset: contains(database, 'charset') ? database.charset : ''
+      collation: database.?collation ?? ''
+      charset: database.?charset ?? ''
     }
   }
 ]
@@ -345,8 +358,8 @@ module flexibleServer_configurations 'configuration/main.bicep' = [
     params: {
       name: configuration.name
       flexibleServerName: flexibleServer.name
-      source: contains(configuration, 'source') ? configuration.source : ''
-      value: contains(configuration, 'value') ? configuration.value : ''
+      source: configuration.?source ?? ''
+      value: configuration.?value ?? ''
     }
     dependsOn: [
       flexibleServer_firewallRules
@@ -362,7 +375,7 @@ module flexibleServer_administrators 'administrator/main.bicep' = [
       objectId: administrator.objectId
       principalName: administrator.principalName
       principalType: administrator.principalType
-      tenantId: contains(administrator, 'tenantId') ? administrator.tenantId : tenant().tenantId
+      tenantId: administrator.?tenantId ?? tenant().tenantId
     }
   }
 ]
@@ -429,6 +442,9 @@ type lockType = {
 }?
 
 type roleAssignmentType = {
+  @description('Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated.')
+  name: string?
+
   @description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
   roleDefinitionIdOrName: string
 
diff --git a/avm/res/db-for-postgre-sql/flexible-server/main.json b/avm/res/db-for-postgre-sql/flexible-server/main.json
index f89dcb945d..2c67a4f617 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/main.json
+++ b/avm/res/db-for-postgre-sql/flexible-server/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "6917599378543885817"
+      "version": "0.29.47.4906",
+      "templateHash": "4308585226053074434"
     },
     "name": "DBforPostgreSQL Flexible Servers",
     "description": "This module deploys a DBforPostgreSQL Flexible Server.",
@@ -58,6 +58,13 @@
       "items": {
         "type": "object",
         "properties": {
+          "name": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+            }
+          },
           "roleDefinitionIdOrName": {
             "type": "string",
             "metadata": {
@@ -406,13 +413,14 @@
     },
     "version": {
       "type": "string",
-      "defaultValue": "15",
+      "defaultValue": "16",
       "allowedValues": [
         "11",
         "12",
         "13",
         "14",
-        "15"
+        "15",
+        "16"
       ],
       "metadata": {
         "description": "Optional. PostgreSQL Server version."
@@ -420,7 +428,7 @@
     },
     "highAvailability": {
       "type": "string",
-      "defaultValue": "Disabled",
+      "defaultValue": "ZoneRedundant",
       "allowedValues": [
         "Disabled",
         "SameZone",
@@ -457,7 +465,12 @@
     },
     "maintenanceWindow": {
       "type": "object",
-      "defaultValue": {},
+      "defaultValue": {
+        "customWindow": "Enabled",
+        "dayOfWeek": 0,
+        "startHour": 1,
+        "startMinute": 0
+      },
       "metadata": {
         "description": "Optional. Properties for the maintenence window. If provided, 'customWindow' property must exist and set to 'Enabled'."
       }
@@ -545,6 +558,13 @@
     }
   },
   "variables": {
+    "copy": [
+      {
+        "name": "formattedRoleAssignments",
+        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+      }
+    ],
     "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
     "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None'), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
     "builtInRoleNames": {
@@ -667,20 +687,20 @@
     "flexibleServer_roleAssignments": {
       "copy": {
         "name": "flexibleServer_roleAssignments",
-        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
       },
       "type": "Microsoft.Authorization/roleAssignments",
       "apiVersion": "2022-04-01",
       "scope": "[format('Microsoft.DBforPostgreSQL/flexibleServers/{0}', parameters('name'))]",
-      "name": "[guid(resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DBforPostgreSQL/flexibleServers', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
       "properties": {
-        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
       },
       "dependsOn": [
         "flexibleServer"
@@ -747,8 +767,12 @@
           "flexibleServerName": {
             "value": "[parameters('name')]"
           },
-          "collation": "[if(contains(parameters('databases')[copyIndex()], 'collation'), createObject('value', parameters('databases')[copyIndex()].collation), createObject('value', ''))]",
-          "charset": "[if(contains(parameters('databases')[copyIndex()], 'charset'), createObject('value', parameters('databases')[copyIndex()].charset), createObject('value', ''))]"
+          "collation": {
+            "value": "[coalesce(tryGet(parameters('databases')[copyIndex()], 'collation'), '')]"
+          },
+          "charset": {
+            "value": "[coalesce(tryGet(parameters('databases')[copyIndex()], 'charset'), '')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -756,8 +780,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "6060199938382421423"
+              "version": "0.29.47.4906",
+              "templateHash": "17501165975344742322"
             },
             "name": "DBforPostgreSQL Flexible Server Databases",
             "description": "This module deploys a DBforPostgreSQL Flexible Server Database.",
@@ -864,8 +888,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "18047073594923038356"
+              "version": "0.29.47.4906",
+              "templateHash": "5110779562094536429"
             },
             "name": "DBforPostgreSQL Flexible Server Firewall Rules",
             "description": "This module deploys a DBforPostgreSQL Flexible Server Firewall Rule.",
@@ -960,8 +984,12 @@
           "flexibleServerName": {
             "value": "[parameters('name')]"
           },
-          "source": "[if(contains(parameters('configurations')[copyIndex()], 'source'), createObject('value', parameters('configurations')[copyIndex()].source), createObject('value', ''))]",
-          "value": "[if(contains(parameters('configurations')[copyIndex()], 'value'), createObject('value', parameters('configurations')[copyIndex()].value), createObject('value', ''))]"
+          "source": {
+            "value": "[coalesce(tryGet(parameters('configurations')[copyIndex()], 'source'), '')]"
+          },
+          "value": {
+            "value": "[coalesce(tryGet(parameters('configurations')[copyIndex()], 'value'), '')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -969,8 +997,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "1739518705583408324"
+              "version": "0.29.47.4906",
+              "templateHash": "3802666632340288344"
             },
             "name": "DBforPostgreSQL Flexible Server Configurations",
             "description": "This module deploys a DBforPostgreSQL Flexible Server Configuration.",
@@ -1071,7 +1099,9 @@
           "principalType": {
             "value": "[parameters('administrators')[copyIndex()].principalType]"
           },
-          "tenantId": "[if(contains(parameters('administrators')[copyIndex()], 'tenantId'), createObject('value', parameters('administrators')[copyIndex()].tenantId), createObject('value', tenant().tenantId))]"
+          "tenantId": {
+            "value": "[coalesce(tryGet(parameters('administrators')[copyIndex()], 'tenantId'), tenant().tenantId)]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -1079,8 +1109,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "18164580138640455419"
+              "version": "0.29.47.4906",
+              "templateHash": "9786947819042824705"
             },
             "name": "DBforPostgreSQL Flexible Server Administrators",
             "description": "This module deploys a DBforPostgreSQL Flexible Server Administrator.",
diff --git a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/dependencies.bicep b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/dependencies.bicep
new file mode 100644
index 0000000000..7ddc0bfb00
--- /dev/null
+++ b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/dependencies.bicep
@@ -0,0 +1,16 @@
+@description('Optional. The location to deploy to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Managed Identity to create.')
+param managedIdentityName string
+
+resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: managedIdentityName
+  location: location
+}
+
+@description('The client ID of the created Managed Identity.')
+output managedIdentityClientId string = managedIdentity.properties.clientId
+
+@description('The name of the created Managed Identity.')
+output managedIdentityName string = managedIdentity.name
diff --git a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/main.test.bicep b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/main.test.bicep
index f7848f4b41..6c56f5b441 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/defaults/main.test.bicep
@@ -17,10 +17,6 @@ param resourceLocation string = deployment().location
 @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
 param serviceShort string = 'dfpsfsmin'
 
-@description('Optional. The password to leverage for the login.')
-@secure()
-param password string = newGuid()
-
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
@@ -35,21 +31,37 @@ resource resourceGroup 'Microsoft.Resources/resourceGroups@2023-07-01' = {
   location: resourceLocation
 }
 
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    location: resourceLocation
+  }
+}
 // ============== //
 // Test Execution //
 // ============== //
 
 @batchSize(1)
-module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
-  params: {
-    name: '${namePrefix}${serviceShort}001'
-    location: resourceLocation
-    administratorLogin: 'adminUserName'
-    administratorLoginPassword: password
-    skuName: 'Standard_B2s'
-    tier: 'Burstable'
-    geoRedundantBackup: 'Enabled'
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      administrators: [
+        {
+          objectId: nestedDependencies.outputs.managedIdentityClientId
+          principalName: nestedDependencies.outputs.managedIdentityName
+          principalType: 'ServicePrincipal'
+        }
+      ]
+      skuName: 'Standard_D2s_v3'
+      tier: 'GeneralPurpose'
+      geoRedundantBackup: 'Enabled'
+      highAvailability: 'ZoneRedundant'
+    }
   }
-}]
+]
diff --git a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/public/main.test.bicep b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/public/main.test.bicep
index 834c02cbb9..01b6ee55cc 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/public/main.test.bicep
+++ b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/public/main.test.bicep
@@ -59,99 +59,100 @@ module diagnosticDependencies '../../../../../../utilities/e2e-template-assets/t
 // ============== //
 
 @batchSize(1)
-module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
-  params: {
-    name: '${namePrefix}${serviceShort}001'
-    administrators: [
-      {
-        objectId: nestedDependencies.outputs.managedIdentityClientId
-        principalName: nestedDependencies.outputs.managedIdentityName
-        principalType: 'ServicePrincipal'
-      }
-    ]
-    skuName: 'Standard_D2s_v3'
-    tier: 'GeneralPurpose'
-    backupRetentionDays: 20
-    configurations: [
-      {
-        name: 'log_min_messages'
-        source: 'user-override'
-        value: 'INFO'
-      }
-    ]
-    databases: [
-      {
-        charset: 'UTF8'
-        collation: 'en_US.utf8'
-        name: 'testdb1'
-      }
-      {
-        name: 'testdb2'
-      }
-    ]
-    roleAssignments: [
-      {
-        roleDefinitionIdOrName: 'Owner'
-        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
-        principalType: 'ServicePrincipal'
-      }
-      {
-        roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
-        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
-        principalType: 'ServicePrincipal'
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      administrators: [
+        {
+          objectId: nestedDependencies.outputs.managedIdentityClientId
+          principalName: nestedDependencies.outputs.managedIdentityName
+          principalType: 'ServicePrincipal'
+        }
+      ]
+      skuName: 'Standard_D2s_v3'
+      tier: 'GeneralPurpose'
+      backupRetentionDays: 20
+      configurations: [
+        {
+          name: 'log_min_messages'
+          source: 'user-override'
+          value: 'INFO'
+        }
+      ]
+      databases: [
+        {
+          charset: 'UTF8'
+          collation: 'en_US.utf8'
+          name: 'testdb1'
+        }
+        {
+          name: 'testdb2'
+        }
+      ]
+      roleAssignments: [
+        {
+          roleDefinitionIdOrName: 'Owner'
+          principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+          principalType: 'ServicePrincipal'
+        }
+        {
+          roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
+          principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+          principalType: 'ServicePrincipal'
+        }
+        {
+          roleDefinitionIdOrName: subscriptionResourceId(
+            'Microsoft.Authorization/roleDefinitions',
+            'acdd72a7-3385-48ef-bd42-f606fba81ae7'
+          )
+          principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+          principalType: 'ServicePrincipal'
+        }
+      ]
+      diagnosticSettings: [
+        {
+          name: 'customSetting'
+          metricCategories: [
+            {
+              category: 'AllMetrics'
+            }
+          ]
+          eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
+          eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
+          storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
+          workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+        }
+      ]
+      firewallRules: [
+        {
+          endIpAddress: '0.0.0.0'
+          name: 'AllowAllWindowsAzureIps'
+          startIpAddress: '0.0.0.0'
+        }
+        {
+          endIpAddress: '10.10.10.10'
+          name: 'test-rule1'
+          startIpAddress: '10.10.10.1'
+        }
+        {
+          endIpAddress: '100.100.100.10'
+          name: 'test-rule2'
+          startIpAddress: '100.100.100.1'
+        }
+      ]
+      geoRedundantBackup: 'Disabled'
+      highAvailability: 'SameZone'
+      location: resourceLocation
+      storageSizeGB: 1024
+      version: '14'
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
       }
-      {
-        roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
-        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
-        principalType: 'ServicePrincipal'
-      }
-    ]
-    diagnosticSettings: [
-      {
-        name: 'customSetting'
-        metricCategories: [
-          {
-            category: 'AllMetrics'
-          }
-        ]
-        eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
-        eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
-        storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
-        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
-      }
-    ]
-    firewallRules: [
-      {
-        endIpAddress: '0.0.0.0'
-        name: 'AllowAllWindowsAzureIps'
-        startIpAddress: '0.0.0.0'
-      }
-      {
-        endIpAddress: '10.10.10.10'
-        name: 'test-rule1'
-        startIpAddress: '10.10.10.1'
-      }
-      {
-        endIpAddress: '100.100.100.10'
-        name: 'test-rule2'
-        startIpAddress: '100.100.100.1'
-      }
-    ]
-    geoRedundantBackup: 'Disabled'
-    highAvailability: 'SameZone'
-    location: resourceLocation
-    storageSizeGB: 1024
-    version: '14'
-    tags: {
-      'hidden-title': 'This is visible in the resource name'
-      Environment: 'Non-Prod'
-      Role: 'DeploymentValidation'
     }
   }
-  dependsOn: [
-    nestedDependencies
-    diagnosticDependencies
-  ]
-}]
+]
diff --git a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/waf-aligned/main.test.bicep b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/waf-aligned/main.test.bicep
index 395890f8fb..f33e849678 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/db-for-postgre-sql/flexible-server/tests/e2e/waf-aligned/main.test.bicep
@@ -62,62 +62,71 @@ module diagnosticDependencies '../../../../../../utilities/e2e-template-assets/t
 // ============== //
 
 @batchSize(1)
-module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
-  params: {
-    name: '${namePrefix}${serviceShort}001'
-    location: resourceLocation
-    administrators: [
-      {
-        objectId: nestedDependencies.outputs.managedIdentityClientId
-        principalName: nestedDependencies.outputs.managedIdentityName
-        principalType: 'ServicePrincipal'
-      }
-    ]
-    skuName: 'Standard_D2s_v3'
-    tier: 'GeneralPurpose'
-    configurations: [
-      {
-        name: 'log_min_messages'
-        source: 'user-override'
-        value: 'INFO'
-      }
-      {
-        name: 'autovacuum_naptime'
-        source: 'user-override'
-        value: '80'
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      administrators: [
+        {
+          objectId: nestedDependencies.outputs.managedIdentityClientId
+          principalName: nestedDependencies.outputs.managedIdentityName
+          principalType: 'ServicePrincipal'
+        }
+      ]
+      skuName: 'Standard_D2s_v3'
+      tier: 'GeneralPurpose'
+      configurations: [
+        {
+          name: 'log_min_messages'
+          source: 'user-override'
+          value: 'INFO'
+        }
+        {
+          name: 'autovacuum_naptime'
+          source: 'user-override'
+          value: '80'
+        }
+      ]
+      databases: [
+        {
+          charset: 'UTF8'
+          collation: 'en_US.utf8'
+          name: 'testdb1'
+        }
+        {
+          name: 'testdb2'
+        }
+      ]
+      delegatedSubnetResourceId: nestedDependencies.outputs.subnetResourceId
+      diagnosticSettings: [
+        {
+          eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
+          eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
+          storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
+          workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+        }
+      ]
+      geoRedundantBackup: 'Enabled'
+      privateDnsZoneArmResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
       }
-    ]
-    databases: [
-      {
-        charset: 'UTF8'
-        collation: 'en_US.utf8'
-        name: 'testdb1'
-      }
-      {
-        name: 'testdb2'
-      }
-    ]
-    delegatedSubnetResourceId: nestedDependencies.outputs.subnetResourceId
-    diagnosticSettings: [
-      {
-        eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
-        eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
-        storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
-        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+      maintenanceWindow: {
+        customWindow: 'Enabled'
+        dayOfWeek: 0
+        startHour: 1
+        startMinute: 0
       }
-    ]
-    geoRedundantBackup: 'Enabled'
-    privateDnsZoneArmResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
-    tags: {
-      'hidden-title': 'This is visible in the resource name'
-      Environment: 'Non-Prod'
-      Role: 'DeploymentValidation'
+      highAvailability: 'ZoneRedundant'
     }
+    dependsOn: [
+      nestedDependencies
+      diagnosticDependencies
+    ]
   }
-  dependsOn: [
-    nestedDependencies
-    diagnosticDependencies
-  ]
-}]
+]
diff --git a/avm/res/db-for-postgre-sql/flexible-server/version.json b/avm/res/db-for-postgre-sql/flexible-server/version.json
index 83083db694..1c035df49f 100644
--- a/avm/res/db-for-postgre-sql/flexible-server/version.json
+++ b/avm/res/db-for-postgre-sql/flexible-server/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.1",
+    "version": "0.2",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/desktop-virtualization/workspace/README.md b/avm/res/desktop-virtualization/workspace/README.md
index 9f0cdfcae1..f37ac6ade8 100644
--- a/avm/res/desktop-virtualization/workspace/README.md
+++ b/avm/res/desktop-virtualization/workspace/README.md
@@ -140,9 +140,13 @@ module workspace 'br/public:avm/res/desktop-virtualization/workspace:<version>'
             }
           }
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             principalId: '<principalId>'
@@ -170,9 +174,13 @@ module workspace 'br/public:avm/res/desktop-virtualization/workspace:<version>'
             }
           }
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             principalId: '<principalId>'
@@ -288,9 +296,13 @@ module workspace 'br/public:avm/res/desktop-virtualization/workspace:<version>'
               }
             }
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "principalId": "<principalId>",
@@ -318,9 +330,13 @@ module workspace 'br/public:avm/res/desktop-virtualization/workspace:<version>'
               }
             }
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "principalId": "<principalId>",
@@ -676,7 +692,6 @@ Configuration details for private endpoints.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`service`](#parameter-privateendpointsservice) | string | The service (sub-) type to deploy the private endpoint for. For example "feed" or "global". |
 | [`subnetResourceId`](#parameter-privateendpointssubnetresourceid) | string | Resource ID of the subnet where the endpoint needs to be created. |
 
 **Optional parameters**
@@ -693,19 +708,13 @@ Configuration details for private endpoints.
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
+| [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
+| [`service`](#parameter-privateendpointsservice) | string | The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory". |
 | [`tags`](#parameter-privateendpointstags) | object | Tags to be applied on all resources/resource groups in this deployment. |
 
-### Parameter: `privateEndpoints.service`
-
-The service (sub-) type to deploy the private endpoint for. For example "feed" or "global".
-
-- Required: Yes
-- Type: string
-
 ### Parameter: `privateEndpoints.subnetResourceId`
 
 Resource ID of the subnet where the endpoint needs to be created.
@@ -883,19 +892,71 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
+
+The name of the private DNS zone group config.
+
+- Required: No
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the Private DNS Zone Group.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private link connection to create.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.resourceGroupName`
 
@@ -1001,6 +1062,13 @@ The principal type of the assigned principal ID.
   ]
   ```
 
+### Parameter: `privateEndpoints.service`
+
+The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory".
+
+- Required: No
+- Type: string
+
 ### Parameter: `privateEndpoints.tags`
 
 Tags to be applied on all resources/resource groups in this deployment.
@@ -1126,6 +1194,7 @@ Tags of the resource.
 | :-- | :-- | :-- |
 | `location` | string | The location of the workspace. |
 | `name` | string | The name of the workspace. |
+| `privateEndpoints` | array | The private endpoints of the workspace. |
 | `resourceGroupName` | string | The name of the resource group the workspace was created in. |
 | `resourceId` | string | The resource ID of the workspace. |
 
@@ -1135,7 +1204,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/desktop-virtualization/workspace/main.bicep b/avm/res/desktop-virtualization/workspace/main.bicep
index 34cf7d42c8..c9a61e0606 100644
--- a/avm/res/desktop-virtualization/workspace/main.bicep
+++ b/avm/res/desktop-virtualization/workspace/main.bicep
@@ -105,7 +105,7 @@ resource workspace 'Microsoft.DesktopVirtualization/workspaces@2022-10-14-previe
   }
 }
 
-module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-workspace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -146,8 +146,7 @@ module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -218,6 +217,17 @@ output name string = workspace.name
 @sys.description('The location of the workspace.')
 output location string = workspace.location
 
+@sys.description('The private endpoints of the workspace.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: workspace_privateEndpoints[i].outputs.name
+    resourceId: workspace_privateEndpoints[i].outputs.resourceId
+    groupId: workspace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: workspace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: workspace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // ================ //
 // Definitions      //
 // ================ //
@@ -287,17 +297,29 @@ type privateEndpointType = {
   @sys.description('Optional. The location to deploy the private endpoint to.')
   location: string?
 
-  @sys.description('Required. The service (sub-) type to deploy the private endpoint for. For example "feed" or "global".')
-  service: string
+  @sys.description('Optional. The name of the private link connection to create.')
+  privateLinkServiceConnectionName: string?
+
+  @sys.description('Optional. The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory".')
+  service: string?
 
   @sys.description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @sys.description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @sys.description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @sys.description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @sys.description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @sys.description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @sys.description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @sys.description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @sys.description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/desktop-virtualization/workspace/main.json b/avm/res/desktop-virtualization/workspace/main.json
index 0796a4f8a8..2197a9e47d 100644
--- a/avm/res/desktop-virtualization/workspace/main.json
+++ b/avm/res/desktop-virtualization/workspace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "9485968598204000149"
+      "templateHash": "11955333663184488007"
     },
     "name": "Workspace",
     "description": "This module deploys an Azure Virtual Desktop Workspace.",
@@ -193,33 +193,64 @@
               "description": "Optional. The location to deploy the private endpoint to."
             }
           },
-          "service": {
+          "privateLinkServiceConnectionName": {
             "type": "string",
+            "nullable": true,
             "metadata": {
-              "description": "Required. The service (sub-) type to deploy the private endpoint for. For example \"feed\" or \"global\"."
+              "description": "Optional. The name of the private link connection to create."
             }
           },
-          "subnetResourceId": {
+          "service": {
             "type": "string",
+            "nullable": true,
             "metadata": {
-              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+              "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
             }
           },
-          "privateDnsZoneGroupName": {
+          "subnetResourceId": {
             "type": "string",
-            "nullable": true,
             "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -624,11 +655,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -657,13 +685,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -915,6 +964,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -950,18 +1022,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1042,7 +1107,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1121,7 +1186,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1132,28 +1197,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1161,12 +1250,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1180,27 +1272,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1267,6 +1368,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1310,6 +1418,22 @@
         "description": "The location of the workspace."
       },
       "value": "[reference('workspace', '2022-10-14-preview', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the workspace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/desktop-virtualization/workspace/tests/e2e/max/main.test.bicep b/avm/res/desktop-virtualization/workspace/tests/e2e/max/main.test.bicep
index 0f02193409..ab63e7aa85 100644
--- a/avm/res/desktop-virtualization/workspace/tests/e2e/max/main.test.bicep
+++ b/avm/res/desktop-virtualization/workspace/tests/e2e/max/main.test.bicep
@@ -107,9 +107,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           service: 'feed'
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -145,9 +149,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           service: 'global'
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
diff --git a/avm/res/desktop-virtualization/workspace/version.json b/avm/res/desktop-virtualization/workspace/version.json
index ea4f3b6e67..21226dd43f 100644
--- a/avm/res/desktop-virtualization/workspace/version.json
+++ b/avm/res/desktop-virtualization/workspace/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.5",
+  "version": "0.6",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/res/dev-test-lab/lab/README.md b/avm/res/dev-test-lab/lab/README.md
index 922a33c299..da4135a4ff 100644
--- a/avm/res/dev-test-lab/lab/README.md
+++ b/avm/res/dev-test-lab/lab/README.md
@@ -108,12 +108,11 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
     }
     artifactsources: [
       {
-        branchRef: 'master'
         displayName: 'Public Artifact Repo'
         folderPath: '/Artifacts'
         name: 'Public Repo'
         sourceType: 'GitHub'
-        status: 'Disabled'
+        status: 'Enabled'
         uri: 'https://github.com/Azure/azure-devtestlab.git'
       }
       {
@@ -123,12 +122,28 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
         name: 'Public Environment Repo'
         sourceType: 'GitHub'
         status: 'Disabled'
+        tags: {
+          'hidden-title': 'This is visible in the resource name'
+          labName: 'dtllmax001'
+          resourceType: 'DevTest Lab'
+        }
+        uri: 'https://github.com/Azure/azure-devtestlab.git'
+      }
+      {
+        armTemplateFolderPath: '/ArmTemplates'
+        branchRef: 'main'
+        displayName: 'Private Artifact Repo'
+        folderPath: '/Artifacts'
+        name: 'Private Repo'
+        securityToken: '<securityToken>'
+        status: 'Disabled'
         uri: 'https://github.com/Azure/azure-devtestlab.git'
       }
     ]
     artifactsStorageAccount: '<artifactsStorageAccount>'
     browserConnect: 'Enabled'
     costs: {
+      currencyCode: 'AUD'
       cycleType: 'CalendarMonth'
       status: 'Enabled'
       target: 450
@@ -162,9 +177,7 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
         description: 'Integration configured for auto-shutdown'
         emailRecipient: 'mail@contosodtlmail.com'
         events: [
-          {
-            eventName: 'AutoShutdown'
-          }
+          'AutoShutdown'
         ]
         name: 'autoShutdown'
         notificationLocale: 'en'
@@ -172,9 +185,7 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
       }
       {
         events: [
-          {
-            eventName: 'Cost'
-          }
+          'Cost'
         ]
         name: 'costThreshold'
         webHookUrl: 'https://webhook.contosotest.com'
@@ -267,8 +278,10 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
           time: '0000'
         }
         name: 'LabVmsShutdown'
-        notificationSettingsStatus: 'Enabled'
-        notificationSettingsTimeInMinutes: 30
+        notificationSettings: {
+          status: 'Enabled'
+          timeInMinutes: 30
+        }
         status: 'Enabled'
         taskType: 'LabVmsShutdownTask'
         timeZoneId: 'AUS Eastern Standard Time'
@@ -366,12 +379,11 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
     "artifactsources": {
       "value": [
         {
-          "branchRef": "master",
           "displayName": "Public Artifact Repo",
           "folderPath": "/Artifacts",
           "name": "Public Repo",
           "sourceType": "GitHub",
-          "status": "Disabled",
+          "status": "Enabled",
           "uri": "https://github.com/Azure/azure-devtestlab.git"
         },
         {
@@ -381,6 +393,21 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
           "name": "Public Environment Repo",
           "sourceType": "GitHub",
           "status": "Disabled",
+          "tags": {
+            "hidden-title": "This is visible in the resource name",
+            "labName": "dtllmax001",
+            "resourceType": "DevTest Lab"
+          },
+          "uri": "https://github.com/Azure/azure-devtestlab.git"
+        },
+        {
+          "armTemplateFolderPath": "/ArmTemplates",
+          "branchRef": "main",
+          "displayName": "Private Artifact Repo",
+          "folderPath": "/Artifacts",
+          "name": "Private Repo",
+          "securityToken": "<securityToken>",
+          "status": "Disabled",
           "uri": "https://github.com/Azure/azure-devtestlab.git"
         }
       ]
@@ -393,6 +420,7 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
     },
     "costs": {
       "value": {
+        "currencyCode": "AUD",
         "cycleType": "CalendarMonth",
         "status": "Enabled",
         "target": 450,
@@ -450,9 +478,7 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
           "description": "Integration configured for auto-shutdown",
           "emailRecipient": "mail@contosodtlmail.com",
           "events": [
-            {
-              "eventName": "AutoShutdown"
-            }
+            "AutoShutdown"
           ],
           "name": "autoShutdown",
           "notificationLocale": "en",
@@ -460,9 +486,7 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
         },
         {
           "events": [
-            {
-              "eventName": "Cost"
-            }
+            "Cost"
           ],
           "name": "costThreshold",
           "webHookUrl": "https://webhook.contosotest.com"
@@ -563,8 +587,10 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
             "time": "0000"
           },
           "name": "LabVmsShutdown",
-          "notificationSettingsStatus": "Enabled",
-          "notificationSettingsTimeInMinutes": 30,
+          "notificationSettings": {
+            "status": "Enabled",
+            "timeInMinutes": 30
+          },
           "status": "Enabled",
           "taskType": "LabVmsShutdownTask",
           "timeZoneId": "AUS Eastern Standard Time"
@@ -739,7 +765,7 @@ module lab 'br/public:avm/res/dev-test-lab/lab:<version>' = {
 | [`labStorageType`](#parameter-labstoragetype) | string | Type of storage used by the lab. It can be either Premium or Standard. |
 | [`location`](#parameter-location) | string | Location for all Resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
-| [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. DevTest Labs creates a system-assigned identity by default the first time it creates the lab environment. |
+| [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. For new labs created after 8/10/2020, the lab's system assigned identity is set to On by default and lab owner will not be able to turn this off for the lifecycle of the lab. |
 | [`managementIdentitiesResourceIds`](#parameter-managementidentitiesresourceids) | array | The resource ID(s) to assign to the virtual machines associated with this lab. |
 | [`mandatoryArtifactsResourceIdsLinux`](#parameter-mandatoryartifactsresourceidslinux) | array | The ordered list of artifact resource IDs that should be applied on all Linux VM creations by default, prior to the artifacts specified by the user. |
 | [`mandatoryArtifactsResourceIdsWindows`](#parameter-mandatoryartifactsresourceidswindows) | array | The ordered list of artifact resource IDs that should be applied on all Windows VM creations by default, prior to the artifacts specified by the user. |
@@ -773,7 +799,84 @@ Notification Channels to create for the lab. Required if the schedules property
 
 - Required: No
 - Type: array
-- Default: `[]`
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`events`](#parameter-notificationchannelsevents) | array | The list of event for which this notification is enabled. Can be "AutoShutdown" or "Cost". |
+| [`name`](#parameter-notificationchannelsname) | string | The name of the notification channel. |
+
+**Conditional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`emailRecipient`](#parameter-notificationchannelsemailrecipient) | string | The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty. |
+| [`webHookUrl`](#parameter-notificationchannelswebhookurl) | string | The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`description`](#parameter-notificationchannelsdescription) | string | The description of the notification. |
+| [`notificationLocale`](#parameter-notificationchannelsnotificationlocale) | string | The locale to use when sending a notification (fallback for unsupported languages is EN). |
+| [`tags`](#parameter-notificationchannelstags) | object | The tags of the notification channel. |
+
+### Parameter: `notificationchannels.events`
+
+The list of event for which this notification is enabled. Can be "AutoShutdown" or "Cost".
+
+- Required: Yes
+- Type: array
+
+### Parameter: `notificationchannels.name`
+
+The name of the notification channel.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'autoShutdown'
+    'costThreshold'
+  ]
+  ```
+
+### Parameter: `notificationchannels.emailRecipient`
+
+The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty.
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationchannels.webHookUrl`
+
+The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty.
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationchannels.description`
+
+The description of the notification.
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationchannels.notificationLocale`
+
+The locale to use when sending a notification (fallback for unsupported languages is EN).
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationchannels.tags`
+
+The tags of the notification channel.
+
+- Required: No
+- Type: object
 
 ### Parameter: `announcement`
 
@@ -789,227 +892,248 @@ Artifact sources to create for the lab.
 
 - Required: No
 - Type: array
-- Default: `[]`
 
-### Parameter: `artifactsStorageAccount`
+**Required parameters**
 
-The resource ID of the storage account used to store artifacts and images by the lab. Also used for defaultStorageAccount, defaultPremiumStorageAccount and premiumDataDiskStorageAccount properties. If left empty, a default storage account will be created by the lab and used.
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-artifactsourcesname) | string | The name of the artifact source. |
+| [`uri`](#parameter-artifactsourcesuri) | string | The artifact source's URI. |
+
+**Conditional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`armTemplateFolderPath`](#parameter-artifactsourcesarmtemplatefolderpath) | string | The folder containing Azure Resource Manager templates. Required if "folderPath" is empty. |
+| [`folderPath`](#parameter-artifactsourcesfolderpath) | string | The folder containing artifacts. At least one folder path is required. Required if "armTemplateFolderPath" is empty. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`branchRef`](#parameter-artifactsourcesbranchref) | string | The artifact source's branch reference (e.g. main or master). |
+| [`displayName`](#parameter-artifactsourcesdisplayname) | string | The display name of the artifact source. Default is the name of the artifact source. |
+| [`securityToken`](#parameter-artifactsourcessecuritytoken) | securestring | The security token to authenticate to the artifact source. Private artifacts use the system-identity of the lab to store the security token for the artifact source in the lab's managed Azure Key Vault. Access to the Azure Key Vault is granted automatically only when the lab is created with a system-assigned identity. |
+| [`sourceType`](#parameter-artifactsourcessourcetype) | string | The artifact source's type. |
+| [`status`](#parameter-artifactsourcesstatus) | string | Indicates if the artifact source is enabled (values: Enabled, Disabled). Default is "Enabled". |
+| [`tags`](#parameter-artifactsourcestags) | object | The tags of the artifact source. |
+
+### Parameter: `artifactsources.name`
+
+The name of the artifact source.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `artifactsources.uri`
+
+The artifact source's URI.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `artifactsources.armTemplateFolderPath`
+
+The folder containing Azure Resource Manager templates. Required if "folderPath" is empty.
 
 - Required: No
 - Type: string
-- Default: `''`
 
-### Parameter: `browserConnect`
+### Parameter: `artifactsources.folderPath`
 
-Enable browser connect on virtual machines if the lab's VNETs have configured Azure Bastion.
+The folder containing artifacts. At least one folder path is required. Required if "armTemplateFolderPath" is empty.
 
 - Required: No
 - Type: string
-- Default: `'Disabled'`
-- Allowed:
-  ```Bicep
-  [
-    'Disabled'
-    'Enabled'
-  ]
-  ```
 
-### Parameter: `costs`
+### Parameter: `artifactsources.branchRef`
 
-Costs to create for the lab.
+The artifact source's branch reference (e.g. main or master).
 
 - Required: No
-- Type: object
-- Default: `{}`
+- Type: string
 
-### Parameter: `disableAutoUpgradeCseMinorVersion`
+### Parameter: `artifactsources.displayName`
 
-Disable auto upgrade custom script extension minor version.
+The display name of the artifact source. Default is the name of the artifact source.
 
 - Required: No
-- Type: bool
-- Default: `False`
+- Type: string
 
-### Parameter: `enableTelemetry`
+### Parameter: `artifactsources.securityToken`
 
-Enable/Disable usage telemetry for module.
+The security token to authenticate to the artifact source. Private artifacts use the system-identity of the lab to store the security token for the artifact source in the lab's managed Azure Key Vault. Access to the Azure Key Vault is granted automatically only when the lab is created with a system-assigned identity.
 
 - Required: No
-- Type: bool
-- Default: `True`
+- Type: securestring
 
-### Parameter: `encryptionType`
+### Parameter: `artifactsources.sourceType`
 
-Specify how OS and data disks created as part of the lab are encrypted.
+The artifact source's type.
 
 - Required: No
 - Type: string
-- Default: `'EncryptionAtRestWithPlatformKey'`
 - Allowed:
   ```Bicep
   [
-    'EncryptionAtRestWithCustomerKey'
-    'EncryptionAtRestWithPlatformKey'
+    'GitHub'
+    'StorageAccount'
+    'VsoGit'
   ]
   ```
 
-### Parameter: `environmentPermission`
+### Parameter: `artifactsources.status`
 
-The access rights to be granted to the user when provisioning an environment.
+Indicates if the artifact source is enabled (values: Enabled, Disabled). Default is "Enabled".
 
 - Required: No
 - Type: string
-- Default: `'Reader'`
 - Allowed:
   ```Bicep
   [
-    'Contributor'
-    'Reader'
+    'Disabled'
+    'Enabled'
   ]
   ```
 
-### Parameter: `extendedProperties`
+### Parameter: `artifactsources.tags`
 
-Extended properties of the lab used for experimental features.
+The tags of the artifact source.
 
 - Required: No
 - Type: object
-- Default: `{}`
 
-### Parameter: `isolateLabResources`
+### Parameter: `artifactsStorageAccount`
 
-Enable lab resources isolation from the public internet.
+The resource ID of the storage account used to store artifacts and images by the lab. Also used for defaultStorageAccount, defaultPremiumStorageAccount and premiumDataDiskStorageAccount properties. If left empty, a default storage account will be created by the lab and used.
 
 - Required: No
 - Type: string
-- Default: `'Enabled'`
-- Allowed:
-  ```Bicep
-  [
-    'Disabled'
-    'Enabled'
-  ]
-  ```
+- Default: `''`
 
-### Parameter: `labStorageType`
+### Parameter: `browserConnect`
 
-Type of storage used by the lab. It can be either Premium or Standard.
+Enable browser connect on virtual machines if the lab's VNETs have configured Azure Bastion.
 
 - Required: No
 - Type: string
-- Default: `'Premium'`
+- Default: `'Disabled'`
 - Allowed:
   ```Bicep
   [
-    'Premium'
-    'Standard'
-    'StandardSSD'
+    'Disabled'
+    'Enabled'
   ]
   ```
 
-### Parameter: `location`
+### Parameter: `costs`
 
-Location for all Resources.
+Costs to create for the lab.
 
 - Required: No
-- Type: string
-- Default: `[resourceGroup().location]`
-
-### Parameter: `lock`
+- Type: object
 
-The lock settings of the service.
+**Required parameters**
 
-- Required: No
-- Type: object
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`cycleType`](#parameter-costscycletype) | string | Reporting cycle type. |
 
-**Optional parameters**
+**Conditional parameters**
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`kind`](#parameter-lockkind) | string | Specify the type of lock. |
-| [`name`](#parameter-lockname) | string | Specify the name of lock. |
+| [`cycleEndDateTime`](#parameter-costscycleenddatetime) | string | Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom". |
+| [`cycleStartDateTime`](#parameter-costscyclestartdatetime) | string | Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom". |
 
-### Parameter: `lock.kind`
+**Optional parameters**
 
-Specify the type of lock.
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`currencyCode`](#parameter-costscurrencycode) | string | The currency code of the cost. Default is "USD". |
+| [`status`](#parameter-costsstatus) | string | Target cost status. |
+| [`tags`](#parameter-coststags) | object | The tags of the resource. |
+| [`target`](#parameter-coststarget) | int | Lab target cost (e.g. 100). The target cost will appear in the "Cost trend" chart to allow tracking lab spending relative to the target cost for the current reporting cycleSetting the target cost to 0 will disable all thresholds. |
+| [`thresholdValue100DisplayOnChart`](#parameter-coststhresholdvalue100displayonchart) | string | Target Cost threshold at 100% display on chart. Indicates whether this threshold will be displayed on cost charts. |
+| [`thresholdValue100SendNotificationWhenExceeded`](#parameter-coststhresholdvalue100sendnotificationwhenexceeded) | string | Target cost threshold at 100% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded. |
+| [`thresholdValue125DisplayOnChart`](#parameter-coststhresholdvalue125displayonchart) | string | Target Cost threshold at 125% display on chart. Indicates whether this threshold will be displayed on cost charts. |
+| [`thresholdValue125SendNotificationWhenExceeded`](#parameter-coststhresholdvalue125sendnotificationwhenexceeded) | string | Target cost threshold at 125% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded. |
+| [`thresholdValue25DisplayOnChart`](#parameter-coststhresholdvalue25displayonchart) | string | Target Cost threshold at 25% display on chart. Indicates whether this threshold will be displayed on cost charts. |
+| [`thresholdValue25SendNotificationWhenExceeded`](#parameter-coststhresholdvalue25sendnotificationwhenexceeded) | string | Target cost threshold at 25% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded. |
+| [`thresholdValue50DisplayOnChart`](#parameter-coststhresholdvalue50displayonchart) | string | Target Cost threshold at 50% display on chart. Indicates whether this threshold will be displayed on cost charts. |
+| [`thresholdValue50SendNotificationWhenExceeded`](#parameter-coststhresholdvalue50sendnotificationwhenexceeded) | string | Target cost threshold at 50% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded. |
+| [`thresholdValue75DisplayOnChart`](#parameter-coststhresholdvalue75displayonchart) | string | Target Cost threshold at 75% display on chart. Indicates whether this threshold will be displayed on cost charts. |
+| [`thresholdValue75SendNotificationWhenExceeded`](#parameter-coststhresholdvalue75sendnotificationwhenexceeded) | string | Target cost threshold at 75% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded. |
+
+### Parameter: `costs.cycleType`
+
+Reporting cycle type.
 
-- Required: No
+- Required: Yes
 - Type: string
 - Allowed:
   ```Bicep
   [
-    'CanNotDelete'
-    'None'
-    'ReadOnly'
+    'CalendarMonth'
+    'Custom'
   ]
   ```
 
-### Parameter: `lock.name`
+### Parameter: `costs.cycleEndDateTime`
 
-Specify the name of lock.
+Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom".
 
 - Required: No
 - Type: string
 
-### Parameter: `managedIdentities`
+### Parameter: `costs.cycleStartDateTime`
 
-The managed identity definition for this resource. DevTest Labs creates a system-assigned identity by default the first time it creates the lab environment.
+Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom".
 
 - Required: No
-- Type: object
-
-**Optional parameters**
-
-| Parameter | Type | Description |
-| :-- | :-- | :-- |
-| [`userAssignedResourceIds`](#parameter-managedidentitiesuserassignedresourceids) | array | The resource ID(s) to assign to the resource. Currently, a single user-assigned identity is supported per lab. |
-
-### Parameter: `managedIdentities.userAssignedResourceIds`
-
-The resource ID(s) to assign to the resource. Currently, a single user-assigned identity is supported per lab.
-
-- Required: Yes
-- Type: array
+- Type: string
 
-### Parameter: `managementIdentitiesResourceIds`
+### Parameter: `costs.currencyCode`
 
-The resource ID(s) to assign to the virtual machines associated with this lab.
+The currency code of the cost. Default is "USD".
 
 - Required: No
-- Type: array
-- Default: `[]`
+- Type: string
 
-### Parameter: `mandatoryArtifactsResourceIdsLinux`
+### Parameter: `costs.status`
 
-The ordered list of artifact resource IDs that should be applied on all Linux VM creations by default, prior to the artifacts specified by the user.
+Target cost status.
 
 - Required: No
-- Type: array
-- Default: `[]`
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
 
-### Parameter: `mandatoryArtifactsResourceIdsWindows`
+### Parameter: `costs.tags`
 
-The ordered list of artifact resource IDs that should be applied on all Windows VM creations by default, prior to the artifacts specified by the user.
+The tags of the resource.
 
 - Required: No
-- Type: array
-- Default: `[]`
+- Type: object
 
-### Parameter: `policies`
+### Parameter: `costs.target`
 
-Policies to create for the lab.
+Lab target cost (e.g. 100). The target cost will appear in the "Cost trend" chart to allow tracking lab spending relative to the target cost for the current reporting cycleSetting the target cost to 0 will disable all thresholds.
 
 - Required: No
-- Type: array
-- Default: `[]`
+- Type: int
 
-### Parameter: `premiumDataDisks`
+### Parameter: `costs.thresholdValue100DisplayOnChart`
 
-The setting to enable usage of premium data disks. When its value is "Enabled", creation of standard or premium data disks is allowed. When its value is "Disabled", only creation of standard data disks is allowed. Default is "Disabled".
+Target Cost threshold at 100% display on chart. Indicates whether this threshold will be displayed on cost charts.
 
 - Required: No
 - Type: string
-- Default: `'Disabled'`
 - Allowed:
   ```Bicep
   [
@@ -1018,110 +1142,740 @@ The setting to enable usage of premium data disks. When its value is "Enabled",
   ]
   ```
 
-### Parameter: `roleAssignments`
+### Parameter: `costs.thresholdValue100SendNotificationWhenExceeded`
 
-Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalIds' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+Target cost threshold at 100% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.
 
 - Required: No
-- Type: array
-
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue125DisplayOnChart`
+
+Target Cost threshold at 125% display on chart. Indicates whether this threshold will be displayed on cost charts.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue125SendNotificationWhenExceeded`
+
+Target cost threshold at 125% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue25DisplayOnChart`
+
+Target Cost threshold at 25% display on chart. Indicates whether this threshold will be displayed on cost charts.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue25SendNotificationWhenExceeded`
+
+Target cost threshold at 25% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue50DisplayOnChart`
+
+Target Cost threshold at 50% display on chart. Indicates whether this threshold will be displayed on cost charts.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue50SendNotificationWhenExceeded`
+
+Target cost threshold at 50% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue75DisplayOnChart`
+
+Target Cost threshold at 75% display on chart. Indicates whether this threshold will be displayed on cost charts.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `costs.thresholdValue75SendNotificationWhenExceeded`
+
+Target cost threshold at 75% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `disableAutoUpgradeCseMinorVersion`
+
+Disable auto upgrade custom script extension minor version.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
+### Parameter: `enableTelemetry`
+
+Enable/Disable usage telemetry for module.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+### Parameter: `encryptionType`
+
+Specify how OS and data disks created as part of the lab are encrypted.
+
+- Required: No
+- Type: string
+- Default: `'EncryptionAtRestWithPlatformKey'`
+- Allowed:
+  ```Bicep
+  [
+    'EncryptionAtRestWithCustomerKey'
+    'EncryptionAtRestWithPlatformKey'
+  ]
+  ```
+
+### Parameter: `environmentPermission`
+
+The access rights to be granted to the user when provisioning an environment.
+
+- Required: No
+- Type: string
+- Default: `'Reader'`
+- Allowed:
+  ```Bicep
+  [
+    'Contributor'
+    'Reader'
+  ]
+  ```
+
+### Parameter: `extendedProperties`
+
+Extended properties of the lab used for experimental features.
+
+- Required: No
+- Type: object
+- Default: `{}`
+
+### Parameter: `isolateLabResources`
+
+Enable lab resources isolation from the public internet.
+
+- Required: No
+- Type: string
+- Default: `'Enabled'`
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `labStorageType`
+
+Type of storage used by the lab. It can be either Premium or Standard.
+
+- Required: No
+- Type: string
+- Default: `'Premium'`
+- Allowed:
+  ```Bicep
+  [
+    'Premium'
+    'Standard'
+    'StandardSSD'
+  ]
+  ```
+
+### Parameter: `location`
+
+Location for all Resources.
+
+- Required: No
+- Type: string
+- Default: `[resourceGroup().location]`
+
+### Parameter: `lock`
+
+The lock settings of the service.
+
+- Required: No
+- Type: object
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`kind`](#parameter-lockkind) | string | Specify the type of lock. |
+| [`name`](#parameter-lockname) | string | Specify the name of lock. |
+
+### Parameter: `lock.kind`
+
+Specify the type of lock.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'CanNotDelete'
+    'None'
+    'ReadOnly'
+  ]
+  ```
+
+### Parameter: `lock.name`
+
+Specify the name of lock.
+
+- Required: No
+- Type: string
+
+### Parameter: `managedIdentities`
+
+The managed identity definition for this resource. For new labs created after 8/10/2020, the lab's system assigned identity is set to On by default and lab owner will not be able to turn this off for the lifecycle of the lab.
+
+- Required: No
+- Type: object
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`userAssignedResourceIds`](#parameter-managedidentitiesuserassignedresourceids) | array | The resource ID(s) to assign to the resource. Currently, a single user-assigned identity is supported per lab. |
+
+### Parameter: `managedIdentities.userAssignedResourceIds`
+
+The resource ID(s) to assign to the resource. Currently, a single user-assigned identity is supported per lab.
+
+- Required: Yes
+- Type: array
+
+### Parameter: `managementIdentitiesResourceIds`
+
+The resource ID(s) to assign to the virtual machines associated with this lab.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `mandatoryArtifactsResourceIdsLinux`
+
+The ordered list of artifact resource IDs that should be applied on all Linux VM creations by default, prior to the artifacts specified by the user.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `mandatoryArtifactsResourceIdsWindows`
+
+The ordered list of artifact resource IDs that should be applied on all Windows VM creations by default, prior to the artifacts specified by the user.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `policies`
+
+Policies to create for the lab.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`evaluatorType`](#parameter-policiesevaluatortype) | string | The evaluator type of the policy (i.e. AllowedValuesPolicy, MaxValuePolicy). |
+| [`factName`](#parameter-policiesfactname) | string | The fact name of the policy. |
+| [`name`](#parameter-policiesname) | string | The name of the policy. |
+| [`threshold`](#parameter-policiesthreshold) | string | The threshold of the policy (i.e. a number for MaxValuePolicy, and a JSON array of values for AllowedValuesPolicy). |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`description`](#parameter-policiesdescription) | string | The description of the policy. |
+| [`factData`](#parameter-policiesfactdata) | string | The fact data of the policy. |
+| [`status`](#parameter-policiesstatus) | string | The status of the policy. Default is "Enabled". |
+
+### Parameter: `policies.evaluatorType`
+
+The evaluator type of the policy (i.e. AllowedValuesPolicy, MaxValuePolicy).
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'AllowedValuesPolicy'
+    'MaxValuePolicy'
+  ]
+  ```
+
+### Parameter: `policies.factName`
+
+The fact name of the policy.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'EnvironmentTemplate'
+    'GalleryImage'
+    'LabPremiumVmCount'
+    'LabTargetCost'
+    'LabVmCount'
+    'LabVmSize'
+    'ScheduleEditPermission'
+    'UserOwnedLabPremiumVmCount'
+    'UserOwnedLabVmCount'
+    'UserOwnedLabVmCountInSubnet'
+  ]
+  ```
+
+### Parameter: `policies.name`
+
+The name of the policy.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `policies.threshold`
+
+The threshold of the policy (i.e. a number for MaxValuePolicy, and a JSON array of values for AllowedValuesPolicy).
+
+- Required: Yes
+- Type: string
+
+### Parameter: `policies.description`
+
+The description of the policy.
+
+- Required: No
+- Type: string
+
+### Parameter: `policies.factData`
+
+The fact data of the policy.
+
+- Required: No
+- Type: string
+
+### Parameter: `policies.status`
+
+The status of the policy. Default is "Enabled".
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `premiumDataDisks`
+
+The setting to enable usage of premium data disks. When its value is "Enabled", creation of standard or premium data disks is allowed. When its value is "Disabled", only creation of standard data disks is allowed. Default is "Disabled".
+
+- Required: No
+- Type: string
+- Default: `'Disabled'`
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
+
+### Parameter: `roleAssignments`
+
+Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalIds' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`principalId`](#parameter-roleassignmentsprincipalid) | string | The principal ID of the principal (user/group/identity) to assign the role to. |
+| [`roleDefinitionIdOrName`](#parameter-roleassignmentsroledefinitionidorname) | string | The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`condition`](#parameter-roleassignmentscondition) | string | The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container". |
+| [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
+| [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
+| [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
+| [`name`](#parameter-roleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
+| [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
+
+### Parameter: `roleAssignments.principalId`
+
+The principal ID of the principal (user/group/identity) to assign the role to.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `roleAssignments.roleDefinitionIdOrName`
+
+The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `roleAssignments.condition`
+
+The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.conditionVersion`
+
+Version of the condition.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    '2.0'
+  ]
+  ```
+
+### Parameter: `roleAssignments.delegatedManagedIdentityResourceId`
+
+The Resource Id of the delegated managed identity resource.
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.description`
+
+The description of the role assignment.
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.name`
+
+The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.principalType`
+
+The principal type of the assigned principal ID.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Device'
+    'ForeignGroup'
+    'Group'
+    'ServicePrincipal'
+    'User'
+  ]
+  ```
+
+### Parameter: `schedules`
+
+Schedules to create for the lab.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-schedulesname) | string | The name of the schedule. |
+| [`taskType`](#parameter-schedulestasktype) | string | The task type of the schedule (e.g. LabVmsShutdownTask, LabVmsStartupTask). |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`dailyRecurrence`](#parameter-schedulesdailyrecurrence) | object | The daily recurrence of the schedule. |
+| [`hourlyRecurrence`](#parameter-scheduleshourlyrecurrence) | object | If the schedule will occur multiple times a day, specify the hourly recurrence. |
+| [`notificationSettings`](#parameter-schedulesnotificationsettings) | object | The notification settings for the schedule. |
+| [`status`](#parameter-schedulesstatus) | string | The status of the schedule (i.e. Enabled, Disabled). Default is "Enabled". |
+| [`tags`](#parameter-schedulestags) | object | The tags of the schedule. |
+| [`targetResourceId`](#parameter-schedulestargetresourceid) | string | The resource ID to which the schedule belongs. |
+| [`timeZoneId`](#parameter-schedulestimezoneid) | string | The time zone ID of the schedule. Defaults to "Pacific Standard time". |
+| [`weeklyRecurrence`](#parameter-schedulesweeklyrecurrence) | object | If the schedule will occur only some days of the week, specify the weekly recurrence. |
+
+### Parameter: `schedules.name`
+
+The name of the schedule.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'LabVmAutoStart'
+    'LabVmsShutdown'
+  ]
+  ```
+
+### Parameter: `schedules.taskType`
+
+The task type of the schedule (e.g. LabVmsShutdownTask, LabVmsStartupTask).
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'LabVmsShutdownTask'
+    'LabVmsStartupTask'
+  ]
+  ```
+
+### Parameter: `schedules.dailyRecurrence`
+
+The daily recurrence of the schedule.
+
+- Required: No
+- Type: object
+
 **Required parameters**
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`principalId`](#parameter-roleassignmentsprincipalid) | string | The principal ID of the principal (user/group/identity) to assign the role to. |
-| [`roleDefinitionIdOrName`](#parameter-roleassignmentsroledefinitionidorname) | string | The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
+| [`time`](#parameter-schedulesdailyrecurrencetime) | string | The time of day the schedule will occur. |
 
-**Optional parameters**
+### Parameter: `schedules.dailyRecurrence.time`
+
+The time of day the schedule will occur.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `schedules.hourlyRecurrence`
+
+If the schedule will occur multiple times a day, specify the hourly recurrence.
+
+- Required: No
+- Type: object
+
+**Required parameters**
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`condition`](#parameter-roleassignmentscondition) | string | The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container". |
-| [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
-| [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
-| [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
-| [`name`](#parameter-roleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
-| [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
+| [`minute`](#parameter-scheduleshourlyrecurrenceminute) | int | Minutes of the hour the schedule will run. |
 
-### Parameter: `roleAssignments.principalId`
+### Parameter: `schedules.hourlyRecurrence.minute`
 
-The principal ID of the principal (user/group/identity) to assign the role to.
+Minutes of the hour the schedule will run.
 
 - Required: Yes
+- Type: int
+
+### Parameter: `schedules.notificationSettings`
+
+The notification settings for the schedule.
+
+- Required: No
+- Type: object
+
+**Conditional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`emailRecipient`](#parameter-schedulesnotificationsettingsemailrecipient) | string | The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty. |
+| [`webHookUrl`](#parameter-schedulesnotificationsettingswebhookurl) | string | The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`notificationLocale`](#parameter-schedulesnotificationsettingsnotificationlocale) | string | The locale to use when sending a notification (fallback for unsupported languages is EN). |
+| [`status`](#parameter-schedulesnotificationsettingsstatus) | string | If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled. |
+| [`timeInMinutes`](#parameter-schedulesnotificationsettingstimeinminutes) | int | Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified. |
+
+### Parameter: `schedules.notificationSettings.emailRecipient`
+
+The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty.
+
+- Required: No
 - Type: string
 
-### Parameter: `roleAssignments.roleDefinitionIdOrName`
+### Parameter: `schedules.notificationSettings.webHookUrl`
 
-The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty.
 
-- Required: Yes
+- Required: No
 - Type: string
 
-### Parameter: `roleAssignments.condition`
+### Parameter: `schedules.notificationSettings.notificationLocale`
 
-The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".
+The locale to use when sending a notification (fallback for unsupported languages is EN).
 
 - Required: No
 - Type: string
 
-### Parameter: `roleAssignments.conditionVersion`
+### Parameter: `schedules.notificationSettings.status`
 
-Version of the condition.
+If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled.
 
 - Required: No
 - Type: string
 - Allowed:
   ```Bicep
   [
-    '2.0'
+    'Disabled'
+    'Enabled'
   ]
   ```
 
-### Parameter: `roleAssignments.delegatedManagedIdentityResourceId`
+### Parameter: `schedules.notificationSettings.timeInMinutes`
 
-The Resource Id of the delegated managed identity resource.
+Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified.
 
 - Required: No
-- Type: string
+- Type: int
 
-### Parameter: `roleAssignments.description`
+### Parameter: `schedules.status`
 
-The description of the role assignment.
+The status of the schedule (i.e. Enabled, Disabled). Default is "Enabled".
 
 - Required: No
 - Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Disabled'
+    'Enabled'
+  ]
+  ```
 
-### Parameter: `roleAssignments.name`
+### Parameter: `schedules.tags`
 
-The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+The tags of the schedule.
+
+- Required: No
+- Type: object
+
+### Parameter: `schedules.targetResourceId`
+
+The resource ID to which the schedule belongs.
 
 - Required: No
 - Type: string
 
-### Parameter: `roleAssignments.principalType`
+### Parameter: `schedules.timeZoneId`
 
-The principal type of the assigned principal ID.
+The time zone ID of the schedule. Defaults to "Pacific Standard time".
 
 - Required: No
 - Type: string
-- Allowed:
-  ```Bicep
-  [
-    'Device'
-    'ForeignGroup'
-    'Group'
-    'ServicePrincipal'
-    'User'
-  ]
-  ```
 
-### Parameter: `schedules`
+### Parameter: `schedules.weeklyRecurrence`
 
-Schedules to create for the lab.
+If the schedule will occur only some days of the week, specify the weekly recurrence.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`time`](#parameter-schedulesweeklyrecurrencetime) | string | The time of day the schedule will occur. |
+| [`weekdays`](#parameter-schedulesweeklyrecurrenceweekdays) | array | The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.). |
+
+### Parameter: `schedules.weeklyRecurrence.time`
+
+The time of day the schedule will occur.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `schedules.weeklyRecurrence.weekdays`
+
+The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.).
+
+- Required: Yes
 - Type: array
-- Default: `[]`
 
 ### Parameter: `support`
 
@@ -1144,7 +1898,221 @@ Virtual networks to create for the lab.
 
 - Required: No
 - Type: array
-- Default: `[]`
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`externalProviderResourceId`](#parameter-virtualnetworksexternalproviderresourceid) | string | The external provider resource ID of the virtual network. |
+| [`name`](#parameter-virtualnetworksname) | string | The name of the virtual network. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`allowedSubnets`](#parameter-virtualnetworksallowedsubnets) | array | The allowed subnets of the virtual network. |
+| [`description`](#parameter-virtualnetworksdescription) | string | The description of the virtual network. |
+| [`subnetOverrides`](#parameter-virtualnetworkssubnetoverrides) | array | The subnet overrides of the virtual network. |
+| [`tags`](#parameter-virtualnetworkstags) | object | The tags of the virtual network. |
+
+### Parameter: `virtualnetworks.externalProviderResourceId`
+
+The external provider resource ID of the virtual network.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `virtualnetworks.name`
+
+The name of the virtual network.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `virtualnetworks.allowedSubnets`
+
+The allowed subnets of the virtual network.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`labSubnetName`](#parameter-virtualnetworksallowedsubnetslabsubnetname) | string | The name of the subnet as seen in the lab. |
+| [`resourceId`](#parameter-virtualnetworksallowedsubnetsresourceid) | string | The resource ID of the allowed subnet. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`allowPublicIp`](#parameter-virtualnetworksallowedsubnetsallowpublicip) | string | The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny)). |
+
+### Parameter: `virtualnetworks.allowedSubnets.labSubnetName`
+
+The name of the subnet as seen in the lab.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `virtualnetworks.allowedSubnets.resourceId`
+
+The resource ID of the allowed subnet.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `virtualnetworks.allowedSubnets.allowPublicIp`
+
+The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny)).
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Allow'
+    'Default'
+    'Deny'
+  ]
+  ```
+
+### Parameter: `virtualnetworks.description`
+
+The description of the virtual network.
+
+- Required: No
+- Type: string
+
+### Parameter: `virtualnetworks.subnetOverrides`
+
+The subnet overrides of the virtual network.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`labSubnetName`](#parameter-virtualnetworkssubnetoverrideslabsubnetname) | string | The name given to the subnet within the lab. |
+| [`resourceId`](#parameter-virtualnetworkssubnetoverridesresourceid) | string | The resource ID of the subnet. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`sharedPublicIpAddressConfiguration`](#parameter-virtualnetworkssubnetoverridessharedpublicipaddressconfiguration) | object | The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny)). |
+| [`useInVmCreationPermission`](#parameter-virtualnetworkssubnetoverridesuseinvmcreationpermission) | string | Indicates whether this subnet can be used during virtual machine creation (i.e. Allow, Deny). |
+| [`usePublicIpAddressPermission`](#parameter-virtualnetworkssubnetoverridesusepublicipaddresspermission) | string | Indicates whether public IP addresses can be assigned to virtual machines on this subnet (i.e. Allow, Deny). |
+| [`virtualNetworkPoolName`](#parameter-virtualnetworkssubnetoverridesvirtualnetworkpoolname) | string | The virtual network pool associated with this subnet. |
+
+### Parameter: `virtualnetworks.subnetOverrides.labSubnetName`
+
+The name given to the subnet within the lab.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `virtualnetworks.subnetOverrides.resourceId`
+
+The resource ID of the subnet.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `virtualnetworks.subnetOverrides.sharedPublicIpAddressConfiguration`
+
+The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny)).
+
+- Required: Yes
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`allowedPorts`](#parameter-virtualnetworkssubnetoverridessharedpublicipaddressconfigurationallowedports) | array | Backend ports that virtual machines on this subnet are allowed to expose. |
+
+### Parameter: `virtualnetworks.subnetOverrides.sharedPublicIpAddressConfiguration.allowedPorts`
+
+Backend ports that virtual machines on this subnet are allowed to expose.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`backendPort`](#parameter-virtualnetworkssubnetoverridessharedpublicipaddressconfigurationallowedportsbackendport) | int | Backend port of the target virtual machine. |
+| [`transportProtocol`](#parameter-virtualnetworkssubnetoverridessharedpublicipaddressconfigurationallowedportstransportprotocol) | string | Protocol type of the port. |
+
+### Parameter: `virtualnetworks.subnetOverrides.sharedPublicIpAddressConfiguration.allowedPorts.backendPort`
+
+Backend port of the target virtual machine.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `virtualnetworks.subnetOverrides.sharedPublicIpAddressConfiguration.allowedPorts.transportProtocol`
+
+Protocol type of the port.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Tcp'
+    'Udp'
+  ]
+  ```
+
+### Parameter: `virtualnetworks.subnetOverrides.useInVmCreationPermission`
+
+Indicates whether this subnet can be used during virtual machine creation (i.e. Allow, Deny).
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Allow'
+    'Default'
+    'Deny'
+  ]
+  ```
+
+### Parameter: `virtualnetworks.subnetOverrides.usePublicIpAddressPermission`
+
+Indicates whether public IP addresses can be assigned to virtual machines on this subnet (i.e. Allow, Deny).
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Allow'
+    'Default'
+    'Deny'
+  ]
+  ```
+
+### Parameter: `virtualnetworks.subnetOverrides.virtualNetworkPoolName`
+
+The virtual network pool associated with this subnet.
+
+- Required: No
+- Type: string
+
+### Parameter: `virtualnetworks.tags`
+
+The tags of the virtual network.
+
+- Required: No
+- Type: object
 
 ### Parameter: `vmCreationResourceGroupId`
 
diff --git a/avm/res/dev-test-lab/lab/artifactsource/README.md b/avm/res/dev-test-lab/lab/artifactsource/README.md
index 12f2e95968..f968a5a2cb 100644
--- a/avm/res/dev-test-lab/lab/artifactsource/README.md
+++ b/avm/res/dev-test-lab/lab/artifactsource/README.md
@@ -64,7 +64,6 @@ The folder containing Azure Resource Manager templates. Required if "folderPath"
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `folderPath`
 
@@ -72,7 +71,6 @@ The folder containing artifacts. At least one folder path is required. Required
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `labName`
 
@@ -87,7 +85,6 @@ The artifact source's branch reference (e.g. main or master).
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `displayName`
 
@@ -103,7 +100,6 @@ The security token to authenticate to the artifact source.
 
 - Required: No
 - Type: securestring
-- Default: `''`
 
 ### Parameter: `sourceType`
 
@@ -111,11 +107,9 @@ The artifact source's type.
 
 - Required: No
 - Type: string
-- Default: `''`
 - Allowed:
   ```Bicep
   [
-    ''
     'GitHub'
     'StorageAccount'
     'VsoGit'
diff --git a/avm/res/dev-test-lab/lab/artifactsource/main.bicep b/avm/res/dev-test-lab/lab/artifactsource/main.bicep
index b350884783..cf9fecf54b 100644
--- a/avm/res/dev-test-lab/lab/artifactsource/main.bicep
+++ b/avm/res/dev-test-lab/lab/artifactsource/main.bicep
@@ -17,26 +17,25 @@ param tags object?
 param displayName string = name
 
 @sys.description('Optional. The artifact source\'s branch reference (e.g. main or master).')
-param branchRef string = ''
+param branchRef string?
 
 @sys.description('Conditional. The folder containing artifacts. At least one folder path is required. Required if "armTemplateFolderPath" is empty.')
-param folderPath string = ''
+param folderPath string?
 
 @sys.description('Conditional. The folder containing Azure Resource Manager templates. Required if "folderPath" is empty.')
-param armTemplateFolderPath string = ''
+param armTemplateFolderPath string?
 
 @sys.description('Optional. The security token to authenticate to the artifact source.')
 @secure()
-param securityToken string = ''
+param securityToken string?
 
 @allowed([
-  ''
   'GitHub'
   'StorageAccount'
   'VsoGit'
 ])
 @sys.description('Optional. The artifact source\'s type.')
-param sourceType string = ''
+param sourceType string?
 
 @allowed([
   'Enabled'
@@ -58,11 +57,11 @@ resource artifactsource 'Microsoft.DevTestLab/labs/artifactsources@2018-09-15' =
   tags: tags
   properties: {
     displayName: displayName
-    branchRef: !empty(branchRef) ? branchRef : null
-    folderPath: !empty(folderPath) ? folderPath : null
-    armTemplateFolderPath: !empty(armTemplateFolderPath) ? armTemplateFolderPath : null
-    securityToken: !empty(securityToken) ? securityToken : null
-    sourceType: !empty(sourceType) ? sourceType : null
+    branchRef: branchRef
+    folderPath: folderPath
+    armTemplateFolderPath: armTemplateFolderPath
+    securityToken: securityToken
+    sourceType: sourceType
     status: status
     uri: uri
   }
diff --git a/avm/res/dev-test-lab/lab/artifactsource/main.json b/avm/res/dev-test-lab/lab/artifactsource/main.json
index cf2720c644..d6c775b85b 100644
--- a/avm/res/dev-test-lab/lab/artifactsource/main.json
+++ b/avm/res/dev-test-lab/lab/artifactsource/main.json
@@ -6,10 +6,10 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "15552685312013632487"
+      "templateHash": "13904061272597362111"
     },
     "name": "DevTest Lab Artifact Sources",
-    "description": "This module deploys a DevTest Lab Artifact Source.\n\nAn artifact source allows you to create custom artifacts for the VMs in the lab, or use Azure Resource Manager templates to create a custom test environment. You must add a private Git repository for the artifacts or Resource Manager templates that your team creates. The repository can be hosted on GitHub or on Azure DevOps Services.",
+    "description": "This module deploys a DevTest Lab Artifact Source.\r\n\r\nAn artifact source allows you to create custom artifacts for the VMs in the lab, or use Azure Resource Manager templates to create a custom test environment. You must add a private Git repository for the artifacts or Resource Manager templates that your team creates. The repository can be hosted on GitHub or on Azure DevOps Services.",
     "owner": "Azure/module-maintainers"
   },
   "parameters": {
@@ -41,37 +41,36 @@
     },
     "branchRef": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Optional. The artifact source's branch reference (e.g. main or master)."
       }
     },
     "folderPath": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Conditional. The folder containing artifacts. At least one folder path is required. Required if \"armTemplateFolderPath\" is empty."
       }
     },
     "armTemplateFolderPath": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Conditional. The folder containing Azure Resource Manager templates. Required if \"folderPath\" is empty."
       }
     },
     "securityToken": {
       "type": "securestring",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Optional. The security token to authenticate to the artifact source."
       }
     },
     "sourceType": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "allowedValues": [
-        "",
         "GitHub",
         "StorageAccount",
         "VsoGit"
@@ -112,11 +111,11 @@
       "tags": "[parameters('tags')]",
       "properties": {
         "displayName": "[parameters('displayName')]",
-        "branchRef": "[if(not(empty(parameters('branchRef'))), parameters('branchRef'), null())]",
-        "folderPath": "[if(not(empty(parameters('folderPath'))), parameters('folderPath'), null())]",
-        "armTemplateFolderPath": "[if(not(empty(parameters('armTemplateFolderPath'))), parameters('armTemplateFolderPath'), null())]",
-        "securityToken": "[if(not(empty(parameters('securityToken'))), parameters('securityToken'), null())]",
-        "sourceType": "[if(not(empty(parameters('sourceType'))), parameters('sourceType'), null())]",
+        "branchRef": "[parameters('branchRef')]",
+        "folderPath": "[parameters('folderPath')]",
+        "armTemplateFolderPath": "[parameters('armTemplateFolderPath')]",
+        "securityToken": "[parameters('securityToken')]",
+        "sourceType": "[parameters('sourceType')]",
         "status": "[parameters('status')]",
         "uri": "[parameters('uri')]"
       },
diff --git a/avm/res/dev-test-lab/lab/cost/README.md b/avm/res/dev-test-lab/lab/cost/README.md
index 1da365c9ef..3755bef6b9 100644
--- a/avm/res/dev-test-lab/lab/cost/README.md
+++ b/avm/res/dev-test-lab/lab/cost/README.md
@@ -71,7 +71,6 @@ Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z)
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `cycleStartDateTime`
 
@@ -79,7 +78,6 @@ Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `labName`
 
diff --git a/avm/res/dev-test-lab/lab/cost/main.bicep b/avm/res/dev-test-lab/lab/cost/main.bicep
index a380c409b0..0cd9280b88 100644
--- a/avm/res/dev-test-lab/lab/cost/main.bicep
+++ b/avm/res/dev-test-lab/lab/cost/main.bicep
@@ -18,10 +18,10 @@ param cycleType string
 param tags object?
 
 @sys.description('Conditional. Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom".')
-param cycleStartDateTime string = ''
+param cycleStartDateTime string?
 
 @sys.description('Conditional. Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom".')
-param cycleEndDateTime string = ''
+param cycleEndDateTime string?
 
 @allowed([
   'Enabled'
diff --git a/avm/res/dev-test-lab/lab/cost/main.json b/avm/res/dev-test-lab/lab/cost/main.json
index 3b38827bc4..ff19b73a67 100644
--- a/avm/res/dev-test-lab/lab/cost/main.json
+++ b/avm/res/dev-test-lab/lab/cost/main.json
@@ -6,10 +6,10 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "16348143074487982445"
+      "templateHash": "7509251296299887127"
     },
     "name": "DevTest Lab Costs",
-    "description": "This module deploys a DevTest Lab Cost.\n\nManage lab costs by setting a spending target that can be viewed in the Monthly Estimated Cost Trend chart. DevTest Labs can send a notification when spending reaches the specified target threshold.",
+    "description": "This module deploys a DevTest Lab Cost.\r\n\r\nManage lab costs by setting a spending target that can be viewed in the Monthly Estimated Cost Trend chart. DevTest Labs can send a notification when spending reaches the specified target threshold.",
     "owner": "Azure/module-maintainers"
   },
   "parameters": {
@@ -38,14 +38,14 @@
     },
     "cycleStartDateTime": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Conditional. Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to \"Custom\"."
       }
     },
     "cycleEndDateTime": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Conditional. Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to \"Custom\"."
       }
diff --git a/avm/res/dev-test-lab/lab/main.bicep b/avm/res/dev-test-lab/lab/main.bicep
index 15db191482..3d0fe3a7ce 100644
--- a/avm/res/dev-test-lab/lab/main.bicep
+++ b/avm/res/dev-test-lab/lab/main.bicep
@@ -57,7 +57,7 @@ param premiumDataDisks string = 'Disabled'
 @description('Optional. The properties of any lab support message associated with this lab.')
 param support object = {}
 
-@description('Optional. The managed identity definition for this resource. DevTest Labs creates a system-assigned identity by default the first time it creates the lab environment.')
+@description('Optional. The managed identity definition for this resource. For new labs created after 8/10/2020, the lab\'s system assigned identity is set to On by default and lab owner will not be able to turn this off for the lifecycle of the lab.')
 param managedIdentities managedIdentitiesType
 
 @description('Optional. The resource ID(s) to assign to the virtual machines associated with this lab.')
@@ -94,22 +94,22 @@ param encryptionType string = 'EncryptionAtRestWithPlatformKey'
 param encryptionDiskEncryptionSetId string = ''
 
 @description('Optional. Virtual networks to create for the lab.')
-param virtualnetworks array = []
+param virtualnetworks virtualNetworkType
 
 @description('Optional. Policies to create for the lab.')
-param policies array = []
+param policies policiesType
 
 @description('Optional. Schedules to create for the lab.')
-param schedules array = []
+param schedules scheduleType
 
 @description('Conditional. Notification Channels to create for the lab. Required if the schedules property "notificationSettingsStatus" is set to "Enabled.')
-param notificationchannels array = []
+param notificationchannels notificationChannelType
 
 @description('Optional. Artifact sources to create for the lab.')
-param artifactsources array = []
+param artifactsources artifactsourcesType
 
 @description('Optional. Costs to create for the lab.')
-param costs object = {}
+param costs costsType
 
 @description('Optional. Enable/Disable usage telemetry for module.')
 param enableTelemetry bool = true
@@ -125,7 +125,9 @@ var identity = !empty(managedIdentities)
       type: !empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned'
       userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
     }
-  : any(null)
+  : {
+      type: 'SystemAssigned'
+    }
 
 var formattedManagementIdentities = !empty(managementIdentitiesResourceIds)
   ? reduce(map((managementIdentitiesResourceIds ?? []), (id) => { '${id}': {} }), {}, (cur, next) => union(cur, next))
@@ -226,95 +228,86 @@ resource lab_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?
 }
 
 module lab_virtualNetworks 'virtualnetwork/main.bicep' = [
-  for (virtualNetwork, index) in virtualnetworks: {
+  for (virtualNetwork, index) in (virtualnetworks ?? []): {
     name: '${uniqueString(deployment().name, location)}-Lab-VirtualNetwork-${index}'
     params: {
       labName: lab.name
       name: virtualNetwork.name
       tags: virtualNetwork.?tags ?? tags
       externalProviderResourceId: virtualNetwork.externalProviderResourceId
-      description: contains(virtualNetwork, 'description') ? virtualNetwork.description : ''
-      allowedSubnets: contains(virtualNetwork, 'allowedSubnets') ? virtualNetwork.allowedSubnets : []
-      subnetOverrides: contains(virtualNetwork, 'subnetOverrides') ? virtualNetwork.subnetOverrides : []
+      description: virtualNetwork.?description
+      allowedSubnets: virtualNetwork.?allowedSubnets
+      subnetOverrides: virtualNetwork.?subnetOverrides
     }
   }
 ]
 
 module lab_policies 'policyset/policy/main.bicep' = [
-  for (policy, index) in policies: {
+  for (policy, index) in (policies ?? []): {
     name: '${uniqueString(deployment().name, location)}-Lab-PolicySets-Policy-${index}'
     params: {
       labName: lab.name
       name: policy.name
-
-      description: contains(policy, 'description') ? policy.description : ''
+      description: policy.?description
       evaluatorType: policy.evaluatorType
-      factData: contains(policy, 'factData') ? policy.factData : ''
+      factData: policy.?factData
       factName: policy.factName
-      status: contains(policy, 'status') ? policy.status : 'Enabled'
+      status: policy.?status ?? 'Enabled'
       threshold: policy.threshold
     }
   }
 ]
 
 module lab_schedules 'schedule/main.bicep' = [
-  for (schedule, index) in schedules: {
+  for (schedule, index) in (schedules ?? []): {
     name: '${uniqueString(deployment().name, location)}-Lab-Schedules-${index}'
     params: {
       labName: lab.name
       name: schedule.name
       tags: schedule.?tags ?? tags
       taskType: schedule.taskType
-      dailyRecurrence: contains(schedule, 'dailyRecurrence') ? schedule.dailyRecurrence : {}
-      hourlyRecurrence: contains(schedule, 'hourlyRecurrence') ? schedule.hourlyRecurrence : {}
-      weeklyRecurrence: contains(schedule, 'weeklyRecurrence') ? schedule.weeklyRecurrence : {}
-      status: contains(schedule, 'status') ? schedule.status : 'Enabled'
-      targetResourceId: contains(schedule, 'targetResourceId') ? schedule.targetResourceId : ''
-      timeZoneId: contains(schedule, 'timeZoneId') ? schedule.timeZoneId : 'Pacific Standard time'
-      notificationSettingsStatus: contains(schedule, 'notificationSettingsStatus')
-        ? schedule.notificationSettingsStatus
-        : 'Disabled'
-      notificationSettingsTimeInMinutes: contains(schedule, 'notificationSettingsTimeInMinutes')
-        ? schedule.notificationSettingsTimeInMinutes
-        : 30
+      dailyRecurrence: schedule.?dailyRecurrence
+      hourlyRecurrence: schedule.?hourlyRecurrence
+      weeklyRecurrence: schedule.?weeklyRecurrence
+      status: schedule.?status ?? 'Enabled'
+      targetResourceId: schedule.?targetResourceId
+      timeZoneId: schedule.?timeZoneId ?? 'Pacific Standard time'
+      notificationSettings: schedule.?notificationSettings
     }
   }
 ]
 
 module lab_notificationChannels 'notificationchannel/main.bicep' = [
-  for (notificationChannel, index) in notificationchannels: {
+  for (notificationChannel, index) in (notificationchannels ?? []): {
     name: '${uniqueString(deployment().name, location)}-Lab-NotificationChannels-${index}'
     params: {
       labName: lab.name
       name: notificationChannel.name
       tags: notificationChannel.?tags ?? tags
-      description: contains(notificationChannel, 'description') ? notificationChannel.description : ''
+      description: notificationChannel.?description
       events: notificationChannel.events
-      emailRecipient: contains(notificationChannel, 'emailRecipient') ? notificationChannel.emailRecipient : ''
-      webHookUrl: contains(notificationChannel, 'webhookUrl') ? notificationChannel.webhookUrl : ''
-      notificationLocale: contains(notificationChannel, 'notificationLocale')
-        ? notificationChannel.notificationLocale
-        : 'en'
+      emailRecipient: notificationChannel.?emailRecipient
+      webHookUrl: notificationChannel.?webHookUrl
+      notificationLocale: notificationChannel.?notificationLocale ?? 'en'
     }
   }
 ]
 
 module lab_artifactSources 'artifactsource/main.bicep' = [
-  for (artifactSource, index) in artifactsources: {
+  for (artifactSource, index) in (artifactsources ?? []): {
     name: '${uniqueString(deployment().name, location)}-Lab-ArtifactSources-${index}'
     params: {
       labName: lab.name
       name: artifactSource.name
       tags: artifactSource.?tags ?? tags
-      displayName: contains(artifactSource, 'displayName') ? artifactSource.displayName : artifactSource.name
-      branchRef: contains(artifactSource, 'branchRef') ? artifactSource.branchRef : ''
-      folderPath: contains(artifactSource, 'folderPath') ? artifactSource.folderPath : ''
-      armTemplateFolderPath: contains(artifactSource, 'armTemplateFolderPath')
-        ? artifactSource.armTemplateFolderPath
-        : ''
-      sourceType: contains(artifactSource, 'sourceType') ? artifactSource.sourceType : ''
-      status: contains(artifactSource, 'status') ? artifactSource.status : 'Enabled'
+      displayName: artifactSource.?displayName ?? artifactSource.name
+      branchRef: artifactSource.?branchRef
+      folderPath: artifactSource.?folderPath
+      armTemplateFolderPath: artifactSource.?armTemplateFolderPath
+      sourceType: artifactSource.?sourceType
+      status: artifactSource.?status ?? 'Enabled'
       uri: artifactSource.uri
+      securityToken: artifactSource.?securityToken
     }
   }
 ]
@@ -324,42 +317,22 @@ module lab_costs 'cost/main.bicep' = if (!empty(costs)) {
   params: {
     labName: lab.name
     tags: costs.?tags ?? tags
-    currencyCode: contains(costs, 'currencyCode') ? costs.currencyCode : 'USD'
-    cycleType: costs.cycleType
-    cycleStartDateTime: contains(costs, 'cycleStartDateTime') ? costs.cycleStartDateTime : ''
-    cycleEndDateTime: contains(costs, 'cycleEndDateTime') ? costs.cycleEndDateTime : ''
-    status: contains(costs, 'status') ? costs.status : 'Enabled'
-    target: contains(costs, 'target') ? costs.target : 0
-    thresholdValue25DisplayOnChart: contains(costs, 'thresholdValue25DisplayOnChart')
-      ? costs.thresholdValue25DisplayOnChart
-      : 'Disabled'
-    thresholdValue25SendNotificationWhenExceeded: contains(costs, 'thresholdValue25SendNotificationWhenExceeded')
-      ? costs.thresholdValue25SendNotificationWhenExceeded
-      : 'Disabled'
-    thresholdValue50DisplayOnChart: contains(costs, 'thresholdValue50DisplayOnChart')
-      ? costs.thresholdValue50DisplayOnChart
-      : 'Disabled'
-    thresholdValue50SendNotificationWhenExceeded: contains(costs, 'thresholdValue50SendNotificationWhenExceeded')
-      ? costs.thresholdValue50SendNotificationWhenExceeded
-      : 'Disabled'
-    thresholdValue75DisplayOnChart: contains(costs, 'thresholdValue75DisplayOnChart')
-      ? costs.thresholdValue75DisplayOnChart
-      : 'Disabled'
-    thresholdValue75SendNotificationWhenExceeded: contains(costs, 'thresholdValue75SendNotificationWhenExceeded')
-      ? costs.thresholdValue75SendNotificationWhenExceeded
-      : 'Disabled'
-    thresholdValue100DisplayOnChart: contains(costs, 'thresholdValue100DisplayOnChart')
-      ? costs.thresholdValue100DisplayOnChart
-      : 'Disabled'
-    thresholdValue100SendNotificationWhenExceeded: contains(costs, 'thresholdValue100SendNotificationWhenExceeded')
-      ? costs.thresholdValue100SendNotificationWhenExceeded
-      : 'Disabled'
-    thresholdValue125DisplayOnChart: contains(costs, 'thresholdValue125DisplayOnChart')
-      ? costs.thresholdValue125DisplayOnChart
-      : 'Disabled'
-    thresholdValue125SendNotificationWhenExceeded: contains(costs, 'thresholdValue125SendNotificationWhenExceeded')
-      ? costs.thresholdValue125SendNotificationWhenExceeded
-      : 'Disabled'
+    currencyCode: costs.?currencyCode ?? 'USD'
+    cycleType: costs!.cycleType
+    cycleStartDateTime: costs.?cycleStartDateTime
+    cycleEndDateTime: costs.?cycleEndDateTime
+    status: costs.?status ?? 'Enabled'
+    target: costs.?target ?? 0
+    thresholdValue25DisplayOnChart: costs.?thresholdValue25DisplayOnChart ?? 'Disabled'
+    thresholdValue25SendNotificationWhenExceeded: costs.?thresholdValue25SendNotificationWhenExceeded ?? 'Disabled'
+    thresholdValue50DisplayOnChart: costs.?thresholdValue50DisplayOnChart ?? 'Disabled'
+    thresholdValue50SendNotificationWhenExceeded: costs.?thresholdValue50SendNotificationWhenExceeded ?? 'Disabled'
+    thresholdValue75DisplayOnChart: costs.?thresholdValue75DisplayOnChart ?? 'Disabled'
+    thresholdValue75SendNotificationWhenExceeded: costs.?thresholdValue75SendNotificationWhenExceeded ?? 'Disabled'
+    thresholdValue100DisplayOnChart: costs.?thresholdValue100DisplayOnChart ?? 'Disabled'
+    thresholdValue100SendNotificationWhenExceeded: costs.?thresholdValue100SendNotificationWhenExceeded ?? 'Disabled'
+    thresholdValue125DisplayOnChart: costs.?thresholdValue125DisplayOnChart ?? 'Disabled'
+    thresholdValue125SendNotificationWhenExceeded: costs.?thresholdValue125SendNotificationWhenExceeded ?? 'Disabled'
   }
 }
 
@@ -439,3 +412,199 @@ type roleAssignmentType = {
   @description('Optional. The Resource Id of the delegated managed identity resource.')
   delegatedManagedIdentityResourceId: string?
 }[]?
+
+type artifactsourcesType = {
+  @description('Required. The name of the artifact source.')
+  name: string
+
+  @description('Optional. The tags of the artifact source.')
+  tags: object?
+
+  @description('Optional. The display name of the artifact source. Default is the name of the artifact source.')
+  displayName: string?
+
+  @description('Optional. The artifact source\'s branch reference (e.g. main or master).')
+  branchRef: string?
+
+  @description('Conditional. The folder containing artifacts. At least one folder path is required. Required if "armTemplateFolderPath" is empty.')
+  folderPath: string?
+
+  @description('Conditional. The folder containing Azure Resource Manager templates. Required if "folderPath" is empty.')
+  armTemplateFolderPath: string?
+
+  @description('Optional. The artifact source\'s type.')
+  sourceType: 'GitHub' | 'StorageAccount' | 'VsoGit'?
+
+  @description('Optional. Indicates if the artifact source is enabled (values: Enabled, Disabled). Default is "Enabled".')
+  status: 'Enabled' | 'Disabled'?
+
+  @description('Required. The artifact source\'s URI.')
+  uri: string
+
+  @description('Optional. The security token to authenticate to the artifact source. Private artifacts use the system-identity of the lab to store the security token for the artifact source in the lab\'s managed Azure Key Vault. Access to the Azure Key Vault is granted automatically only when the lab is created with a system-assigned identity.')
+  @secure()
+  securityToken: string?
+}[]?
+
+import { allowedSubnetType, subnetOverrideType } from 'virtualnetwork/main.bicep'
+type virtualNetworkType = {
+  @description('Required. The name of the virtual network.')
+  name: string
+
+  @description('Optional. The tags of the virtual network.')
+  tags: object?
+
+  @description('Required. The external provider resource ID of the virtual network.')
+  externalProviderResourceId: string
+
+  @description('Optional. The description of the virtual network.')
+  description: string?
+
+  @description('Optional. The allowed subnets of the virtual network.')
+  allowedSubnets: allowedSubnetType[]?
+
+  @description('Optional. The subnet overrides of the virtual network.')
+  subnetOverrides: subnetOverrideType[]?
+}[]?
+
+type costsType = {
+  @description('Optional. The tags of the resource.')
+  tags: object?
+
+  @description('Required. Reporting cycle type.')
+  cycleType: 'Custom' | 'CalendarMonth'
+
+  @description('Conditional. Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom".')
+  cycleStartDateTime: string?
+
+  @description('Conditional. Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to "Custom".')
+  cycleEndDateTime: string?
+
+  @description('Optional. Target cost status.')
+  status: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Lab target cost (e.g. 100). The target cost will appear in the "Cost trend" chart to allow tracking lab spending relative to the target cost for the current reporting cycleSetting the target cost to 0 will disable all thresholds.')
+  target: int?
+
+  @description('Optional. The currency code of the cost. Default is "USD".')
+  currencyCode: string?
+
+  @description('Optional. Target Cost threshold at 25% display on chart. Indicates whether this threshold will be displayed on cost charts.')
+  thresholdValue25DisplayOnChart: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target cost threshold at 25% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.')
+  thresholdValue25SendNotificationWhenExceeded: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target Cost threshold at 50% display on chart. Indicates whether this threshold will be displayed on cost charts.')
+  thresholdValue50DisplayOnChart: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target cost threshold at 50% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.')
+  thresholdValue50SendNotificationWhenExceeded: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target Cost threshold at 75% display on chart. Indicates whether this threshold will be displayed on cost charts.')
+  thresholdValue75DisplayOnChart: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target cost threshold at 75% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.')
+  thresholdValue75SendNotificationWhenExceeded: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target Cost threshold at 100% display on chart. Indicates whether this threshold will be displayed on cost charts.')
+  thresholdValue100DisplayOnChart: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target cost threshold at 100% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.')
+  thresholdValue100SendNotificationWhenExceeded: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target Cost threshold at 125% display on chart. Indicates whether this threshold will be displayed on cost charts.')
+  thresholdValue125DisplayOnChart: 'Enabled' | 'Disabled'?
+
+  @description('Optional. Target cost threshold at 125% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded.')
+  thresholdValue125SendNotificationWhenExceeded: 'Enabled' | 'Disabled'?
+}?
+
+type notificationChannelType = {
+  @description('Required. The name of the notification channel.')
+  name: 'autoShutdown' | 'costThreshold'
+
+  @description('Optional. The tags of the notification channel.')
+  tags: object?
+
+  @description('Optional. The description of the notification.')
+  description: string?
+
+  @description('Required. The list of event for which this notification is enabled. Can be "AutoShutdown" or "Cost".')
+  events: string[]
+
+  @description('Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty.')
+  emailRecipient: string?
+
+  @description('Conditional. The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty.')
+  webHookUrl: string?
+
+  @description('Optional. The locale to use when sending a notification (fallback for unsupported languages is EN).')
+  notificationLocale: string?
+}[]?
+
+type policiesType = {
+  @description('Required. The name of the policy.')
+  name: string
+
+  @description('Optional. The description of the policy.')
+  description: string?
+
+  @description('Required. The evaluator type of the policy (i.e. AllowedValuesPolicy, MaxValuePolicy).')
+  evaluatorType: 'AllowedValuesPolicy' | 'MaxValuePolicy'
+
+  @description('Optional. The fact data of the policy.')
+  factData: string?
+
+  @description('Required. The fact name of the policy.')
+  factName:
+    | 'EnvironmentTemplate'
+    | 'GalleryImage'
+    | 'LabPremiumVmCount'
+    | 'LabTargetCost'
+    | 'LabVmCount'
+    | 'LabVmSize'
+    | 'ScheduleEditPermission'
+    | 'UserOwnedLabPremiumVmCount'
+    | 'UserOwnedLabVmCount'
+    | 'UserOwnedLabVmCountInSubnet'
+
+  @description('Optional. The status of the policy. Default is "Enabled".')
+  status: 'Disabled' | 'Enabled'?
+
+  @description('Required. The threshold of the policy (i.e. a number for MaxValuePolicy, and a JSON array of values for AllowedValuesPolicy).')
+  threshold: string
+}[]?
+
+import { dailyRecurrenceType, hourlyRecurrenceType, notificationSettingsType, weeklyRecurrenceType } from 'schedule/main.bicep'
+type scheduleType = {
+  @description('Required. The name of the schedule.')
+  name: 'LabVmsShutdown' | 'LabVmAutoStart'
+
+  @description('Optional. The tags of the schedule.')
+  tags: object?
+
+  @description('Required. The task type of the schedule (e.g. LabVmsShutdownTask, LabVmsStartupTask).')
+  taskType: 'LabVmsShutdownTask' | 'LabVmsStartupTask'
+
+  @description('Optional. The daily recurrence of the schedule.')
+  dailyRecurrence: dailyRecurrenceType?
+
+  @description('Optional. If the schedule will occur multiple times a day, specify the hourly recurrence.')
+  hourlyRecurrence: hourlyRecurrenceType?
+
+  @description('Optional. If the schedule will occur only some days of the week, specify the weekly recurrence.')
+  weeklyRecurrence: weeklyRecurrenceType?
+
+  @description('Optional. The status of the schedule (i.e. Enabled, Disabled). Default is "Enabled".')
+  status: 'Disabled' | 'Enabled'?
+
+  @description('Optional. The resource ID to which the schedule belongs.')
+  targetResourceId: string?
+
+  @description('Optional. The time zone ID of the schedule. Defaults to "Pacific Standard time".')
+  timeZoneId: string?
+
+  @description('Optional. The notification settings for the schedule.')
+  notificationSettings: notificationSettingsType?
+}[]?
diff --git a/avm/res/dev-test-lab/lab/main.json b/avm/res/dev-test-lab/lab/main.json
index e43e8d6a81..711f287f08 100644
--- a/avm/res/dev-test-lab/lab/main.json
+++ b/avm/res/dev-test-lab/lab/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "18263140101339219429"
+      "templateHash": "9164793528274272981"
     },
     "name": "DevTest Labs",
     "description": "This module deploys a DevTest Lab.",
@@ -125,6 +125,777 @@
         }
       },
       "nullable": true
+    },
+    "artifactsourcesType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The name of the artifact source."
+            }
+          },
+          "tags": {
+            "type": "object",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The tags of the artifact source."
+            }
+          },
+          "displayName": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The display name of the artifact source. Default is the name of the artifact source."
+            }
+          },
+          "branchRef": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The artifact source's branch reference (e.g. main or master)."
+            }
+          },
+          "folderPath": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Conditional. The folder containing artifacts. At least one folder path is required. Required if \"armTemplateFolderPath\" is empty."
+            }
+          },
+          "armTemplateFolderPath": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Conditional. The folder containing Azure Resource Manager templates. Required if \"folderPath\" is empty."
+            }
+          },
+          "sourceType": {
+            "type": "string",
+            "allowedValues": [
+              "GitHub",
+              "StorageAccount",
+              "VsoGit"
+            ],
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The artifact source's type."
+            }
+          },
+          "status": {
+            "type": "string",
+            "allowedValues": [
+              "Disabled",
+              "Enabled"
+            ],
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. Indicates if the artifact source is enabled (values: Enabled, Disabled). Default is \"Enabled\"."
+            }
+          },
+          "uri": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The artifact source's URI."
+            }
+          },
+          "securityToken": {
+            "type": "securestring",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The security token to authenticate to the artifact source. Private artifacts use the system-identity of the lab to store the security token for the artifact source in the lab's managed Azure Key Vault. Access to the Azure Key Vault is granted automatically only when the lab is created with a system-assigned identity."
+            }
+          }
+        }
+      },
+      "nullable": true
+    },
+    "virtualNetworkType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The name of the virtual network."
+            }
+          },
+          "tags": {
+            "type": "object",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The tags of the virtual network."
+            }
+          },
+          "externalProviderResourceId": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The external provider resource ID of the virtual network."
+            }
+          },
+          "description": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The description of the virtual network."
+            }
+          },
+          "allowedSubnets": {
+            "type": "array",
+            "items": {
+              "$ref": "#/definitions/allowedSubnetType"
+            },
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The allowed subnets of the virtual network."
+            }
+          },
+          "subnetOverrides": {
+            "type": "array",
+            "items": {
+              "$ref": "#/definitions/subnetOverrideType"
+            },
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The subnet overrides of the virtual network."
+            }
+          }
+        }
+      },
+      "nullable": true
+    },
+    "costsType": {
+      "type": "object",
+      "properties": {
+        "tags": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The tags of the resource."
+          }
+        },
+        "cycleType": {
+          "type": "string",
+          "allowedValues": [
+            "CalendarMonth",
+            "Custom"
+          ],
+          "metadata": {
+            "description": "Required. Reporting cycle type."
+          }
+        },
+        "cycleStartDateTime": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to \"Custom\"."
+          }
+        },
+        "cycleEndDateTime": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to \"Custom\"."
+          }
+        },
+        "status": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target cost status."
+          }
+        },
+        "target": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Lab target cost (e.g. 100). The target cost will appear in the \"Cost trend\" chart to allow tracking lab spending relative to the target cost for the current reporting cycleSetting the target cost to 0 will disable all thresholds."
+          }
+        },
+        "currencyCode": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The currency code of the cost. Default is \"USD\"."
+          }
+        },
+        "thresholdValue25DisplayOnChart": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target Cost threshold at 25% display on chart. Indicates whether this threshold will be displayed on cost charts."
+          }
+        },
+        "thresholdValue25SendNotificationWhenExceeded": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target cost threshold at 25% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded."
+          }
+        },
+        "thresholdValue50DisplayOnChart": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target Cost threshold at 50% display on chart. Indicates whether this threshold will be displayed on cost charts."
+          }
+        },
+        "thresholdValue50SendNotificationWhenExceeded": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target cost threshold at 50% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded."
+          }
+        },
+        "thresholdValue75DisplayOnChart": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target Cost threshold at 75% display on chart. Indicates whether this threshold will be displayed on cost charts."
+          }
+        },
+        "thresholdValue75SendNotificationWhenExceeded": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target cost threshold at 75% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded."
+          }
+        },
+        "thresholdValue100DisplayOnChart": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target Cost threshold at 100% display on chart. Indicates whether this threshold will be displayed on cost charts."
+          }
+        },
+        "thresholdValue100SendNotificationWhenExceeded": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target cost threshold at 100% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded."
+          }
+        },
+        "thresholdValue125DisplayOnChart": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target Cost threshold at 125% display on chart. Indicates whether this threshold will be displayed on cost charts."
+          }
+        },
+        "thresholdValue125SendNotificationWhenExceeded": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Target cost threshold at 125% send notification when exceeded. Indicates whether notifications will be sent when this threshold is exceeded."
+          }
+        }
+      },
+      "nullable": true
+    },
+    "notificationChannelType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "allowedValues": [
+              "autoShutdown",
+              "costThreshold"
+            ],
+            "metadata": {
+              "description": "Required. The name of the notification channel."
+            }
+          },
+          "tags": {
+            "type": "object",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The tags of the notification channel."
+            }
+          },
+          "description": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The description of the notification."
+            }
+          },
+          "events": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "metadata": {
+              "description": "Required. The list of event for which this notification is enabled. Can be \"AutoShutdown\" or \"Cost\"."
+            }
+          },
+          "emailRecipient": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if \"webHookUrl\" is empty."
+            }
+          },
+          "webHookUrl": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Conditional. The webhook URL to which the notification will be sent. Required if \"emailRecipient\" is empty."
+            }
+          },
+          "notificationLocale": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The locale to use when sending a notification (fallback for unsupported languages is EN)."
+            }
+          }
+        }
+      },
+      "nullable": true
+    },
+    "policiesType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The name of the policy."
+            }
+          },
+          "description": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The description of the policy."
+            }
+          },
+          "evaluatorType": {
+            "type": "string",
+            "allowedValues": [
+              "AllowedValuesPolicy",
+              "MaxValuePolicy"
+            ],
+            "metadata": {
+              "description": "Required. The evaluator type of the policy (i.e. AllowedValuesPolicy, MaxValuePolicy)."
+            }
+          },
+          "factData": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The fact data of the policy."
+            }
+          },
+          "factName": {
+            "type": "string",
+            "allowedValues": [
+              "EnvironmentTemplate",
+              "GalleryImage",
+              "LabPremiumVmCount",
+              "LabTargetCost",
+              "LabVmCount",
+              "LabVmSize",
+              "ScheduleEditPermission",
+              "UserOwnedLabPremiumVmCount",
+              "UserOwnedLabVmCount",
+              "UserOwnedLabVmCountInSubnet"
+            ],
+            "metadata": {
+              "description": "Required. The fact name of the policy."
+            }
+          },
+          "status": {
+            "type": "string",
+            "allowedValues": [
+              "Disabled",
+              "Enabled"
+            ],
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The status of the policy. Default is \"Enabled\"."
+            }
+          },
+          "threshold": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The threshold of the policy (i.e. a number for MaxValuePolicy, and a JSON array of values for AllowedValuesPolicy)."
+            }
+          }
+        }
+      },
+      "nullable": true
+    },
+    "scheduleType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "allowedValues": [
+              "LabVmAutoStart",
+              "LabVmsShutdown"
+            ],
+            "metadata": {
+              "description": "Required. The name of the schedule."
+            }
+          },
+          "tags": {
+            "type": "object",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The tags of the schedule."
+            }
+          },
+          "taskType": {
+            "type": "string",
+            "allowedValues": [
+              "LabVmsShutdownTask",
+              "LabVmsStartupTask"
+            ],
+            "metadata": {
+              "description": "Required. The task type of the schedule (e.g. LabVmsShutdownTask, LabVmsStartupTask)."
+            }
+          },
+          "dailyRecurrence": {
+            "$ref": "#/definitions/dailyRecurrenceType",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The daily recurrence of the schedule."
+            }
+          },
+          "hourlyRecurrence": {
+            "$ref": "#/definitions/hourlyRecurrenceType",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. If the schedule will occur multiple times a day, specify the hourly recurrence."
+            }
+          },
+          "weeklyRecurrence": {
+            "$ref": "#/definitions/weeklyRecurrenceType",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. If the schedule will occur only some days of the week, specify the weekly recurrence."
+            }
+          },
+          "status": {
+            "type": "string",
+            "allowedValues": [
+              "Disabled",
+              "Enabled"
+            ],
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The status of the schedule (i.e. Enabled, Disabled). Default is \"Enabled\"."
+            }
+          },
+          "targetResourceId": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The resource ID to which the schedule belongs."
+            }
+          },
+          "timeZoneId": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The time zone ID of the schedule. Defaults to \"Pacific Standard time\"."
+            }
+          },
+          "notificationSettings": {
+            "$ref": "#/definitions/notificationSettingsType",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The notification settings for the schedule."
+            }
+          }
+        }
+      },
+      "nullable": true
+    },
+    "allowedSubnetType": {
+      "type": "object",
+      "properties": {
+        "allowPublicIp": {
+          "type": "string",
+          "allowedValues": [
+            "Allow",
+            "Default",
+            "Deny"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny))."
+          }
+        },
+        "resourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The resource ID of the allowed subnet."
+          }
+        },
+        "labSubnetName": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name of the subnet as seen in the lab."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "virtualnetwork/main.bicep"
+        }
+      }
+    },
+    "dailyRecurrenceType": {
+      "type": "object",
+      "properties": {
+        "time": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The time of day the schedule will occur."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "schedule/main.bicep"
+        }
+      }
+    },
+    "hourlyRecurrenceType": {
+      "type": "object",
+      "properties": {
+        "minute": {
+          "type": "int",
+          "metadata": {
+            "description": "Required. Minutes of the hour the schedule will run."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "schedule/main.bicep"
+        }
+      }
+    },
+    "notificationSettingsType": {
+      "type": "object",
+      "properties": {
+        "emailRecipient": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if \"webHookUrl\" is empty."
+          }
+        },
+        "notificationLocale": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The locale to use when sending a notification (fallback for unsupported languages is EN)."
+          }
+        },
+        "status": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled."
+          }
+        },
+        "timeInMinutes": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified."
+          }
+        },
+        "webHookUrl": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The webhook URL to which the notification will be sent. Required if \"emailRecipient\" is empty."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "schedule/main.bicep"
+        }
+      }
+    },
+    "subnetOverrideType": {
+      "type": "object",
+      "properties": {
+        "labSubnetName": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name given to the subnet within the lab."
+          }
+        },
+        "resourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The resource ID of the subnet."
+          }
+        },
+        "sharedPublicIpAddressConfiguration": {
+          "type": "object",
+          "properties": {
+            "allowedPorts": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "backendPort": {
+                    "type": "int",
+                    "metadata": {
+                      "description": "Required. Backend port of the target virtual machine."
+                    }
+                  },
+                  "transportProtocol": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Tcp",
+                      "Udp"
+                    ],
+                    "metadata": {
+                      "description": "Required. Protocol type of the port."
+                    }
+                  }
+                }
+              },
+              "metadata": {
+                "description": "Required. Backend ports that virtual machines on this subnet are allowed to expose."
+              }
+            }
+          },
+          "metadata": {
+            "description": "Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny))."
+          }
+        },
+        "useInVmCreationPermission": {
+          "type": "string",
+          "allowedValues": [
+            "Allow",
+            "Default",
+            "Deny"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Indicates whether this subnet can be used during virtual machine creation (i.e. Allow, Deny)."
+          }
+        },
+        "usePublicIpAddressPermission": {
+          "type": "string",
+          "allowedValues": [
+            "Allow",
+            "Default",
+            "Deny"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Indicates whether public IP addresses can be assigned to virtual machines on this subnet (i.e. Allow, Deny)."
+          }
+        },
+        "virtualNetworkPoolName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The virtual network pool associated with this subnet."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "virtualnetwork/main.bicep"
+        }
+      }
+    },
+    "weeklyRecurrenceType": {
+      "type": "object",
+      "properties": {
+        "time": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The time of day the schedule will occur."
+          }
+        },
+        "weekdays": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "metadata": {
+            "description": "Required. The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.)."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "schedule/main.bicep"
+        }
+      }
     }
   },
   "parameters": {
@@ -239,7 +1010,7 @@
     "managedIdentities": {
       "$ref": "#/definitions/managedIdentitiesType",
       "metadata": {
-        "description": "Optional. The managed identity definition for this resource. DevTest Labs creates a system-assigned identity by default the first time it creates the lab environment."
+        "description": "Optional. The managed identity definition for this resource. For new labs created after 8/10/2020, the lab's system assigned identity is set to On by default and lab owner will not be able to turn this off for the lifecycle of the lab."
       }
     },
     "managementIdentitiesResourceIds": {
@@ -307,43 +1078,37 @@
       }
     },
     "virtualnetworks": {
-      "type": "array",
-      "defaultValue": [],
+      "$ref": "#/definitions/virtualNetworkType",
       "metadata": {
         "description": "Optional. Virtual networks to create for the lab."
       }
     },
     "policies": {
-      "type": "array",
-      "defaultValue": [],
+      "$ref": "#/definitions/policiesType",
       "metadata": {
         "description": "Optional. Policies to create for the lab."
       }
     },
     "schedules": {
-      "type": "array",
-      "defaultValue": [],
+      "$ref": "#/definitions/scheduleType",
       "metadata": {
         "description": "Optional. Schedules to create for the lab."
       }
     },
     "notificationchannels": {
-      "type": "array",
-      "defaultValue": [],
+      "$ref": "#/definitions/notificationChannelType",
       "metadata": {
         "description": "Conditional. Notification Channels to create for the lab. Required if the schedules property \"notificationSettingsStatus\" is set to \"Enabled."
       }
     },
     "artifactsources": {
-      "type": "array",
-      "defaultValue": [],
+      "$ref": "#/definitions/artifactsourcesType",
       "metadata": {
         "description": "Optional. Artifact sources to create for the lab."
       }
     },
     "costs": {
-      "type": "object",
-      "defaultValue": {},
+      "$ref": "#/definitions/costsType",
       "metadata": {
         "description": "Optional. Costs to create for the lab."
       }
@@ -365,7 +1130,7 @@
       }
     ],
     "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), createObject('type', 'SystemAssigned'))]",
     "formattedManagementIdentities": "[if(not(empty(parameters('managementIdentitiesResourceIds'))), reduce(map(coalesce(parameters('managementIdentitiesResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next')))), createObject())]",
     "builtInRoleNames": {
       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
@@ -466,7 +1231,7 @@
     "lab_virtualNetworks": {
       "copy": {
         "name": "lab_virtualNetworks",
-        "count": "[length(parameters('virtualnetworks'))]"
+        "count": "[length(coalesce(parameters('virtualnetworks'), createArray()))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
@@ -481,17 +1246,23 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[parameters('virtualnetworks')[copyIndex()].name]"
+            "value": "[coalesce(parameters('virtualnetworks'), createArray())[copyIndex()].name]"
           },
           "tags": {
-            "value": "[coalesce(tryGet(parameters('virtualnetworks')[copyIndex()], 'tags'), parameters('tags'))]"
+            "value": "[coalesce(tryGet(coalesce(parameters('virtualnetworks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
           },
           "externalProviderResourceId": {
-            "value": "[parameters('virtualnetworks')[copyIndex()].externalProviderResourceId]"
+            "value": "[coalesce(parameters('virtualnetworks'), createArray())[copyIndex()].externalProviderResourceId]"
+          },
+          "description": {
+            "value": "[tryGet(coalesce(parameters('virtualnetworks'), createArray())[copyIndex()], 'description')]"
+          },
+          "allowedSubnets": {
+            "value": "[tryGet(coalesce(parameters('virtualnetworks'), createArray())[copyIndex()], 'allowedSubnets')]"
           },
-          "description": "[if(contains(parameters('virtualnetworks')[copyIndex()], 'description'), createObject('value', parameters('virtualnetworks')[copyIndex()].description), createObject('value', ''))]",
-          "allowedSubnets": "[if(contains(parameters('virtualnetworks')[copyIndex()], 'allowedSubnets'), createObject('value', parameters('virtualnetworks')[copyIndex()].allowedSubnets), createObject('value', createArray()))]",
-          "subnetOverrides": "[if(contains(parameters('virtualnetworks')[copyIndex()], 'subnetOverrides'), createObject('value', parameters('virtualnetworks')[copyIndex()].subnetOverrides), createObject('value', createArray()))]"
+          "subnetOverrides": {
+            "value": "[tryGet(coalesce(parameters('virtualnetworks'), createArray())[copyIndex()], 'subnetOverrides')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -501,12 +1272,132 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "1030641179919111475"
+              "templateHash": "18309816581107210302"
             },
             "name": "DevTest Lab Virtual Networks",
-            "description": "This module deploys a DevTest Lab Virtual Network.\n\nLab virtual machines must be deployed into a virtual network. This resource type allows configuring the virtual network and subnet settings used for the lab virtual machines.",
+            "description": "This module deploys a DevTest Lab Virtual Network.\r\n\r\nLab virtual machines must be deployed into a virtual network. This resource type allows configuring the virtual network and subnet settings used for the lab virtual machines.",
             "owner": "Azure/module-maintainers"
           },
+          "definitions": {
+            "allowedSubnetType": {
+              "type": "object",
+              "properties": {
+                "allowPublicIp": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Allow",
+                    "Default",
+                    "Deny"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny))."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of the allowed subnet."
+                  }
+                },
+                "labSubnetName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the subnet as seen in the lab."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "subnetOverrideType": {
+              "type": "object",
+              "properties": {
+                "labSubnetName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name given to the subnet within the lab."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource ID of the subnet."
+                  }
+                },
+                "sharedPublicIpAddressConfiguration": {
+                  "type": "object",
+                  "properties": {
+                    "allowedPorts": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "backendPort": {
+                            "type": "int",
+                            "metadata": {
+                              "description": "Required. Backend port of the target virtual machine."
+                            }
+                          },
+                          "transportProtocol": {
+                            "type": "string",
+                            "allowedValues": [
+                              "Tcp",
+                              "Udp"
+                            ],
+                            "metadata": {
+                              "description": "Required. Protocol type of the port."
+                            }
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "Required. Backend ports that virtual machines on this subnet are allowed to expose."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny))."
+                  }
+                },
+                "useInVmCreationPermission": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Allow",
+                    "Default",
+                    "Deny"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Indicates whether this subnet can be used during virtual machine creation (i.e. Allow, Deny)."
+                  }
+                },
+                "usePublicIpAddressPermission": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Allow",
+                    "Default",
+                    "Deny"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Indicates whether public IP addresses can be assigned to virtual machines on this subnet (i.e. Allow, Deny)."
+                  }
+                },
+                "virtualNetworkPoolName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The virtual network pool associated with this subnet."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true
+              }
+            }
+          },
           "parameters": {
             "labName": {
               "type": "string",
@@ -610,7 +1501,7 @@
     "lab_policies": {
       "copy": {
         "name": "lab_policies",
-        "count": "[length(parameters('policies'))]"
+        "count": "[length(coalesce(parameters('policies'), createArray()))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
@@ -625,19 +1516,25 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[parameters('policies')[copyIndex()].name]"
+            "value": "[coalesce(parameters('policies'), createArray())[copyIndex()].name]"
+          },
+          "description": {
+            "value": "[tryGet(coalesce(parameters('policies'), createArray())[copyIndex()], 'description')]"
           },
-          "description": "[if(contains(parameters('policies')[copyIndex()], 'description'), createObject('value', parameters('policies')[copyIndex()].description), createObject('value', ''))]",
           "evaluatorType": {
-            "value": "[parameters('policies')[copyIndex()].evaluatorType]"
+            "value": "[coalesce(parameters('policies'), createArray())[copyIndex()].evaluatorType]"
+          },
+          "factData": {
+            "value": "[tryGet(coalesce(parameters('policies'), createArray())[copyIndex()], 'factData')]"
           },
-          "factData": "[if(contains(parameters('policies')[copyIndex()], 'factData'), createObject('value', parameters('policies')[copyIndex()].factData), createObject('value', ''))]",
           "factName": {
-            "value": "[parameters('policies')[copyIndex()].factName]"
+            "value": "[coalesce(parameters('policies'), createArray())[copyIndex()].factName]"
+          },
+          "status": {
+            "value": "[coalesce(tryGet(coalesce(parameters('policies'), createArray())[copyIndex()], 'status'), 'Enabled')]"
           },
-          "status": "[if(contains(parameters('policies')[copyIndex()], 'status'), createObject('value', parameters('policies')[copyIndex()].status), createObject('value', 'Enabled'))]",
           "threshold": {
-            "value": "[parameters('policies')[copyIndex()].threshold]"
+            "value": "[coalesce(parameters('policies'), createArray())[copyIndex()].threshold]"
           }
         },
         "template": {
@@ -647,10 +1544,10 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "12174587300527865958"
+              "templateHash": "10307787353498465860"
             },
             "name": "DevTest Lab Policy Sets Policies",
-            "description": "This module deploys a DevTest Lab Policy Sets Policy.\n\nDevTest lab policies are used to modify the lab settings such as only allowing certain VM Size SKUs, marketplace image types, number of VMs allowed per user and other settings.",
+            "description": "This module deploys a DevTest Lab Policy Sets Policy.\r\n\r\nDevTest lab policies are used to modify the lab settings such as only allowing certain VM Size SKUs, marketplace image types, number of VMs allowed per user and other settings.",
             "owner": "Azure/module-maintainers"
           },
           "parameters": {
@@ -732,9 +1629,9 @@
               "apiVersion": "2018-09-15",
               "name": "[format('{0}/{1}/{2}', parameters('labName'), 'default', parameters('name'))]",
               "properties": {
-                "description": "[parameters('description')]",
+                "description": "[coalesce(parameters('description'), '')]",
                 "evaluatorType": "[parameters('evaluatorType')]",
-                "factData": "[parameters('factData')]",
+                "factData": "[coalesce(parameters('factData'), '')]",
                 "factName": "[parameters('factName')]",
                 "status": "[parameters('status')]",
                 "threshold": "[parameters('threshold')]"
@@ -773,7 +1670,7 @@
     "lab_schedules": {
       "copy": {
         "name": "lab_schedules",
-        "count": "[length(parameters('schedules'))]"
+        "count": "[length(coalesce(parameters('schedules'), createArray()))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
@@ -788,22 +1685,35 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[parameters('schedules')[copyIndex()].name]"
+            "value": "[coalesce(parameters('schedules'), createArray())[copyIndex()].name]"
           },
           "tags": {
-            "value": "[coalesce(tryGet(parameters('schedules')[copyIndex()], 'tags'), parameters('tags'))]"
+            "value": "[coalesce(tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
           },
           "taskType": {
-            "value": "[parameters('schedules')[copyIndex()].taskType]"
-          },
-          "dailyRecurrence": "[if(contains(parameters('schedules')[copyIndex()], 'dailyRecurrence'), createObject('value', parameters('schedules')[copyIndex()].dailyRecurrence), createObject('value', createObject()))]",
-          "hourlyRecurrence": "[if(contains(parameters('schedules')[copyIndex()], 'hourlyRecurrence'), createObject('value', parameters('schedules')[copyIndex()].hourlyRecurrence), createObject('value', createObject()))]",
-          "weeklyRecurrence": "[if(contains(parameters('schedules')[copyIndex()], 'weeklyRecurrence'), createObject('value', parameters('schedules')[copyIndex()].weeklyRecurrence), createObject('value', createObject()))]",
-          "status": "[if(contains(parameters('schedules')[copyIndex()], 'status'), createObject('value', parameters('schedules')[copyIndex()].status), createObject('value', 'Enabled'))]",
-          "targetResourceId": "[if(contains(parameters('schedules')[copyIndex()], 'targetResourceId'), createObject('value', parameters('schedules')[copyIndex()].targetResourceId), createObject('value', ''))]",
-          "timeZoneId": "[if(contains(parameters('schedules')[copyIndex()], 'timeZoneId'), createObject('value', parameters('schedules')[copyIndex()].timeZoneId), createObject('value', 'Pacific Standard time'))]",
-          "notificationSettingsStatus": "[if(contains(parameters('schedules')[copyIndex()], 'notificationSettingsStatus'), createObject('value', parameters('schedules')[copyIndex()].notificationSettingsStatus), createObject('value', 'Disabled'))]",
-          "notificationSettingsTimeInMinutes": "[if(contains(parameters('schedules')[copyIndex()], 'notificationSettingsTimeInMinutes'), createObject('value', parameters('schedules')[copyIndex()].notificationSettingsTimeInMinutes), createObject('value', 30))]"
+            "value": "[coalesce(parameters('schedules'), createArray())[copyIndex()].taskType]"
+          },
+          "dailyRecurrence": {
+            "value": "[tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'dailyRecurrence')]"
+          },
+          "hourlyRecurrence": {
+            "value": "[tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'hourlyRecurrence')]"
+          },
+          "weeklyRecurrence": {
+            "value": "[tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'weeklyRecurrence')]"
+          },
+          "status": {
+            "value": "[coalesce(tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'status'), 'Enabled')]"
+          },
+          "targetResourceId": {
+            "value": "[tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'targetResourceId')]"
+          },
+          "timeZoneId": {
+            "value": "[coalesce(tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'timeZoneId'), 'Pacific Standard time')]"
+          },
+          "notificationSettings": {
+            "value": "[tryGet(coalesce(parameters('schedules'), createArray())[copyIndex()], 'notificationSettings')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -813,12 +1723,116 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "12081847452316418446"
+              "templateHash": "9010276477624635732"
             },
             "name": "DevTest Lab Schedules",
-            "description": "This module deploys a DevTest Lab Schedule.\n\nLab schedules are used to modify the settings for auto-shutdown, auto-start for lab virtual machines.",
+            "description": "This module deploys a DevTest Lab Schedule.\r\n\r\nLab schedules are used to modify the settings for auto-shutdown, auto-start for lab virtual machines.",
             "owner": "Azure/module-maintainers"
           },
+          "definitions": {
+            "dailyRecurrenceType": {
+              "type": "object",
+              "properties": {
+                "time": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The time of day the schedule will occur."
+                  }
+                }
+              },
+              "nullable": true,
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "hourlyRecurrenceType": {
+              "type": "object",
+              "properties": {
+                "minute": {
+                  "type": "int",
+                  "metadata": {
+                    "description": "Required. Minutes of the hour the schedule will run."
+                  }
+                }
+              },
+              "nullable": true,
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "weeklyRecurrenceType": {
+              "type": "object",
+              "properties": {
+                "time": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The time of day the schedule will occur."
+                  }
+                },
+                "weekdays": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.)."
+                  }
+                }
+              },
+              "nullable": true,
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "notificationSettingsType": {
+              "type": "object",
+              "properties": {
+                "emailRecipient": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if \"webHookUrl\" is empty."
+                  }
+                },
+                "notificationLocale": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The locale to use when sending a notification (fallback for unsupported languages is EN)."
+                  }
+                },
+                "status": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Disabled",
+                    "Enabled"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled."
+                  }
+                },
+                "timeInMinutes": {
+                  "type": "int",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified."
+                  }
+                },
+                "webHookUrl": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The webhook URL to which the notification will be sent. Required if \"emailRecipient\" is empty."
+                  }
+                }
+              },
+              "nullable": true,
+              "metadata": {
+                "__bicep_export!": true
+              }
+            }
+          },
           "parameters": {
             "labName": {
               "type": "string",
@@ -854,22 +1868,19 @@
               }
             },
             "dailyRecurrence": {
-              "type": "object",
-              "defaultValue": {},
+              "$ref": "#/definitions/dailyRecurrenceType",
               "metadata": {
                 "description": "Optional. If the schedule will occur once each day of the week, specify the daily recurrence."
               }
             },
             "hourlyRecurrence": {
-              "type": "object",
-              "defaultValue": {},
+              "$ref": "#/definitions/hourlyRecurrenceType",
               "metadata": {
                 "description": "Optional. If the schedule will occur multiple times a day, specify the hourly recurrence."
               }
             },
             "weeklyRecurrence": {
-              "type": "object",
-              "defaultValue": {},
+              "$ref": "#/definitions/weeklyRecurrenceType",
               "metadata": {
                 "description": "Optional. If the schedule will occur only some days of the week, specify the weekly recurrence."
               }
@@ -887,7 +1898,7 @@
             },
             "targetResourceId": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Optional. The resource ID to which the schedule belongs."
               }
@@ -899,22 +1910,10 @@
                 "description": "Optional. The time zone ID (e.g. Pacific Standard time)."
               }
             },
-            "notificationSettingsStatus": {
-              "type": "string",
-              "defaultValue": "Disabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled)."
-              }
-            },
-            "notificationSettingsTimeInMinutes": {
-              "type": "int",
-              "defaultValue": 30,
+            "notificationSettings": {
+              "$ref": "#/definitions/notificationSettingsType",
               "metadata": {
-                "description": "Optional. Time in minutes before event at which notification will be sent. Optional if \"notificationSettingsStatus\" is set to \"Enabled\". Default is 30 minutes."
+                "description": "Optional. The notification settings for the schedule."
               }
             }
           },
@@ -932,13 +1931,13 @@
               "tags": "[parameters('tags')]",
               "properties": {
                 "taskType": "[parameters('taskType')]",
-                "dailyRecurrence": "[if(not(empty(parameters('dailyRecurrence'))), parameters('dailyRecurrence'), null())]",
-                "hourlyRecurrence": "[if(not(empty(parameters('hourlyRecurrence'))), parameters('hourlyRecurrence'), null())]",
-                "weeklyRecurrence": "[if(not(empty(parameters('weeklyRecurrence'))), parameters('weeklyRecurrence'), null())]",
+                "dailyRecurrence": "[parameters('dailyRecurrence')]",
+                "hourlyRecurrence": "[parameters('hourlyRecurrence')]",
+                "weeklyRecurrence": "[parameters('weeklyRecurrence')]",
                 "status": "[parameters('status')]",
-                "targetResourceId": "[if(not(empty(parameters('targetResourceId'))), parameters('targetResourceId'), null())]",
+                "targetResourceId": "[parameters('targetResourceId')]",
                 "timeZoneId": "[parameters('timeZoneId')]",
-                "notificationSettings": "[if(equals(parameters('notificationSettingsStatus'), 'Enabled'), createObject('status', parameters('notificationSettingsStatus'), 'timeInMinutes', parameters('notificationSettingsTimeInMinutes')), createObject())]"
+                "notificationSettings": "[parameters('notificationSettings')]"
               },
               "dependsOn": [
                 "lab"
@@ -977,7 +1976,7 @@
     "lab_notificationChannels": {
       "copy": {
         "name": "lab_notificationChannels",
-        "count": "[length(parameters('notificationchannels'))]"
+        "count": "[length(coalesce(parameters('notificationchannels'), createArray()))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
@@ -992,18 +1991,26 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[parameters('notificationchannels')[copyIndex()].name]"
+            "value": "[coalesce(parameters('notificationchannels'), createArray())[copyIndex()].name]"
           },
           "tags": {
-            "value": "[coalesce(tryGet(parameters('notificationchannels')[copyIndex()], 'tags'), parameters('tags'))]"
+            "value": "[coalesce(tryGet(coalesce(parameters('notificationchannels'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+          },
+          "description": {
+            "value": "[tryGet(coalesce(parameters('notificationchannels'), createArray())[copyIndex()], 'description')]"
           },
-          "description": "[if(contains(parameters('notificationchannels')[copyIndex()], 'description'), createObject('value', parameters('notificationchannels')[copyIndex()].description), createObject('value', ''))]",
           "events": {
-            "value": "[parameters('notificationchannels')[copyIndex()].events]"
+            "value": "[coalesce(parameters('notificationchannels'), createArray())[copyIndex()].events]"
+          },
+          "emailRecipient": {
+            "value": "[tryGet(coalesce(parameters('notificationchannels'), createArray())[copyIndex()], 'emailRecipient')]"
           },
-          "emailRecipient": "[if(contains(parameters('notificationchannels')[copyIndex()], 'emailRecipient'), createObject('value', parameters('notificationchannels')[copyIndex()].emailRecipient), createObject('value', ''))]",
-          "webHookUrl": "[if(contains(parameters('notificationchannels')[copyIndex()], 'webhookUrl'), createObject('value', parameters('notificationchannels')[copyIndex()].webhookUrl), createObject('value', ''))]",
-          "notificationLocale": "[if(contains(parameters('notificationchannels')[copyIndex()], 'notificationLocale'), createObject('value', parameters('notificationchannels')[copyIndex()].notificationLocale), createObject('value', 'en'))]"
+          "webHookUrl": {
+            "value": "[tryGet(coalesce(parameters('notificationchannels'), createArray())[copyIndex()], 'webHookUrl')]"
+          },
+          "notificationLocale": {
+            "value": "[coalesce(tryGet(coalesce(parameters('notificationchannels'), createArray())[copyIndex()], 'notificationLocale'), 'en')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -1013,10 +2020,10 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "7230564820615005386"
+              "templateHash": "95632191903979650"
             },
             "name": "DevTest Lab Notification Channels",
-            "description": "This module deploys a DevTest Lab Notification Channel.\n\nNotification channels are used by the schedule resource type in order to send notifications or events to email addresses and/or webhooks.",
+            "description": "This module deploys a DevTest Lab Notification Channel.\r\n\r\nNotification channels are used by the schedule resource type in order to send notifications or events to email addresses and/or webhooks.",
             "owner": "Azure/module-maintainers"
           },
           "parameters": {
@@ -1059,7 +2066,7 @@
             },
             "emailRecipient": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if \"webHookUrl\" is empty."
               }
@@ -1092,8 +2099,16 @@
               "name": "[format('{0}/{1}', parameters('labName'), parameters('name'))]",
               "tags": "[parameters('tags')]",
               "properties": {
+                "copy": [
+                  {
+                    "name": "events",
+                    "count": "[length(parameters('events'))]",
+                    "input": {
+                      "eventName": "[parameters('events')[copyIndex('events')]]"
+                    }
+                  }
+                ],
                 "description": "[parameters('description')]",
-                "events": "[parameters('events')]",
                 "emailRecipient": "[parameters('emailRecipient')]",
                 "webHookUrl": "[parameters('webHookUrl')]",
                 "notificationLocale": "[parameters('notificationLocale')]"
@@ -1135,7 +2150,7 @@
     "lab_artifactSources": {
       "copy": {
         "name": "lab_artifactSources",
-        "count": "[length(parameters('artifactsources'))]"
+        "count": "[length(coalesce(parameters('artifactsources'), createArray()))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
@@ -1150,19 +2165,34 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[parameters('artifactsources')[copyIndex()].name]"
+            "value": "[coalesce(parameters('artifactsources'), createArray())[copyIndex()].name]"
           },
           "tags": {
-            "value": "[coalesce(tryGet(parameters('artifactsources')[copyIndex()], 'tags'), parameters('tags'))]"
-          },
-          "displayName": "[if(contains(parameters('artifactsources')[copyIndex()], 'displayName'), createObject('value', parameters('artifactsources')[copyIndex()].displayName), createObject('value', parameters('artifactsources')[copyIndex()].name))]",
-          "branchRef": "[if(contains(parameters('artifactsources')[copyIndex()], 'branchRef'), createObject('value', parameters('artifactsources')[copyIndex()].branchRef), createObject('value', ''))]",
-          "folderPath": "[if(contains(parameters('artifactsources')[copyIndex()], 'folderPath'), createObject('value', parameters('artifactsources')[copyIndex()].folderPath), createObject('value', ''))]",
-          "armTemplateFolderPath": "[if(contains(parameters('artifactsources')[copyIndex()], 'armTemplateFolderPath'), createObject('value', parameters('artifactsources')[copyIndex()].armTemplateFolderPath), createObject('value', ''))]",
-          "sourceType": "[if(contains(parameters('artifactsources')[copyIndex()], 'sourceType'), createObject('value', parameters('artifactsources')[copyIndex()].sourceType), createObject('value', ''))]",
-          "status": "[if(contains(parameters('artifactsources')[copyIndex()], 'status'), createObject('value', parameters('artifactsources')[copyIndex()].status), createObject('value', 'Enabled'))]",
+            "value": "[coalesce(tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+          },
+          "displayName": {
+            "value": "[coalesce(tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'displayName'), coalesce(parameters('artifactsources'), createArray())[copyIndex()].name)]"
+          },
+          "branchRef": {
+            "value": "[tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'branchRef')]"
+          },
+          "folderPath": {
+            "value": "[tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'folderPath')]"
+          },
+          "armTemplateFolderPath": {
+            "value": "[tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'armTemplateFolderPath')]"
+          },
+          "sourceType": {
+            "value": "[tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'sourceType')]"
+          },
+          "status": {
+            "value": "[coalesce(tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'status'), 'Enabled')]"
+          },
           "uri": {
-            "value": "[parameters('artifactsources')[copyIndex()].uri]"
+            "value": "[coalesce(parameters('artifactsources'), createArray())[copyIndex()].uri]"
+          },
+          "securityToken": {
+            "value": "[tryGet(coalesce(parameters('artifactsources'), createArray())[copyIndex()], 'securityToken')]"
           }
         },
         "template": {
@@ -1173,10 +2203,10 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "15552685312013632487"
+              "templateHash": "13904061272597362111"
             },
             "name": "DevTest Lab Artifact Sources",
-            "description": "This module deploys a DevTest Lab Artifact Source.\n\nAn artifact source allows you to create custom artifacts for the VMs in the lab, or use Azure Resource Manager templates to create a custom test environment. You must add a private Git repository for the artifacts or Resource Manager templates that your team creates. The repository can be hosted on GitHub or on Azure DevOps Services.",
+            "description": "This module deploys a DevTest Lab Artifact Source.\r\n\r\nAn artifact source allows you to create custom artifacts for the VMs in the lab, or use Azure Resource Manager templates to create a custom test environment. You must add a private Git repository for the artifacts or Resource Manager templates that your team creates. The repository can be hosted on GitHub or on Azure DevOps Services.",
             "owner": "Azure/module-maintainers"
           },
           "parameters": {
@@ -1208,37 +2238,36 @@
             },
             "branchRef": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Optional. The artifact source's branch reference (e.g. main or master)."
               }
             },
             "folderPath": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Conditional. The folder containing artifacts. At least one folder path is required. Required if \"armTemplateFolderPath\" is empty."
               }
             },
             "armTemplateFolderPath": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Conditional. The folder containing Azure Resource Manager templates. Required if \"folderPath\" is empty."
               }
             },
             "securityToken": {
               "type": "securestring",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Optional. The security token to authenticate to the artifact source."
               }
             },
             "sourceType": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "allowedValues": [
-                "",
                 "GitHub",
                 "StorageAccount",
                 "VsoGit"
@@ -1279,11 +2308,11 @@
               "tags": "[parameters('tags')]",
               "properties": {
                 "displayName": "[parameters('displayName')]",
-                "branchRef": "[if(not(empty(parameters('branchRef'))), parameters('branchRef'), null())]",
-                "folderPath": "[if(not(empty(parameters('folderPath'))), parameters('folderPath'), null())]",
-                "armTemplateFolderPath": "[if(not(empty(parameters('armTemplateFolderPath'))), parameters('armTemplateFolderPath'), null())]",
-                "securityToken": "[if(not(empty(parameters('securityToken'))), parameters('securityToken'), null())]",
-                "sourceType": "[if(not(empty(parameters('sourceType'))), parameters('sourceType'), null())]",
+                "branchRef": "[parameters('branchRef')]",
+                "folderPath": "[parameters('folderPath')]",
+                "armTemplateFolderPath": "[parameters('armTemplateFolderPath')]",
+                "securityToken": "[parameters('securityToken')]",
+                "sourceType": "[parameters('sourceType')]",
                 "status": "[parameters('status')]",
                 "uri": "[parameters('uri')]"
               },
@@ -1338,24 +2367,54 @@
           "tags": {
             "value": "[coalesce(tryGet(parameters('costs'), 'tags'), parameters('tags'))]"
           },
-          "currencyCode": "[if(contains(parameters('costs'), 'currencyCode'), createObject('value', parameters('costs').currencyCode), createObject('value', 'USD'))]",
+          "currencyCode": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'currencyCode'), 'USD')]"
+          },
           "cycleType": {
             "value": "[parameters('costs').cycleType]"
           },
-          "cycleStartDateTime": "[if(contains(parameters('costs'), 'cycleStartDateTime'), createObject('value', parameters('costs').cycleStartDateTime), createObject('value', ''))]",
-          "cycleEndDateTime": "[if(contains(parameters('costs'), 'cycleEndDateTime'), createObject('value', parameters('costs').cycleEndDateTime), createObject('value', ''))]",
-          "status": "[if(contains(parameters('costs'), 'status'), createObject('value', parameters('costs').status), createObject('value', 'Enabled'))]",
-          "target": "[if(contains(parameters('costs'), 'target'), createObject('value', parameters('costs').target), createObject('value', 0))]",
-          "thresholdValue25DisplayOnChart": "[if(contains(parameters('costs'), 'thresholdValue25DisplayOnChart'), createObject('value', parameters('costs').thresholdValue25DisplayOnChart), createObject('value', 'Disabled'))]",
-          "thresholdValue25SendNotificationWhenExceeded": "[if(contains(parameters('costs'), 'thresholdValue25SendNotificationWhenExceeded'), createObject('value', parameters('costs').thresholdValue25SendNotificationWhenExceeded), createObject('value', 'Disabled'))]",
-          "thresholdValue50DisplayOnChart": "[if(contains(parameters('costs'), 'thresholdValue50DisplayOnChart'), createObject('value', parameters('costs').thresholdValue50DisplayOnChart), createObject('value', 'Disabled'))]",
-          "thresholdValue50SendNotificationWhenExceeded": "[if(contains(parameters('costs'), 'thresholdValue50SendNotificationWhenExceeded'), createObject('value', parameters('costs').thresholdValue50SendNotificationWhenExceeded), createObject('value', 'Disabled'))]",
-          "thresholdValue75DisplayOnChart": "[if(contains(parameters('costs'), 'thresholdValue75DisplayOnChart'), createObject('value', parameters('costs').thresholdValue75DisplayOnChart), createObject('value', 'Disabled'))]",
-          "thresholdValue75SendNotificationWhenExceeded": "[if(contains(parameters('costs'), 'thresholdValue75SendNotificationWhenExceeded'), createObject('value', parameters('costs').thresholdValue75SendNotificationWhenExceeded), createObject('value', 'Disabled'))]",
-          "thresholdValue100DisplayOnChart": "[if(contains(parameters('costs'), 'thresholdValue100DisplayOnChart'), createObject('value', parameters('costs').thresholdValue100DisplayOnChart), createObject('value', 'Disabled'))]",
-          "thresholdValue100SendNotificationWhenExceeded": "[if(contains(parameters('costs'), 'thresholdValue100SendNotificationWhenExceeded'), createObject('value', parameters('costs').thresholdValue100SendNotificationWhenExceeded), createObject('value', 'Disabled'))]",
-          "thresholdValue125DisplayOnChart": "[if(contains(parameters('costs'), 'thresholdValue125DisplayOnChart'), createObject('value', parameters('costs').thresholdValue125DisplayOnChart), createObject('value', 'Disabled'))]",
-          "thresholdValue125SendNotificationWhenExceeded": "[if(contains(parameters('costs'), 'thresholdValue125SendNotificationWhenExceeded'), createObject('value', parameters('costs').thresholdValue125SendNotificationWhenExceeded), createObject('value', 'Disabled'))]"
+          "cycleStartDateTime": {
+            "value": "[tryGet(parameters('costs'), 'cycleStartDateTime')]"
+          },
+          "cycleEndDateTime": {
+            "value": "[tryGet(parameters('costs'), 'cycleEndDateTime')]"
+          },
+          "status": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'status'), 'Enabled')]"
+          },
+          "target": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'target'), 0)]"
+          },
+          "thresholdValue25DisplayOnChart": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue25DisplayOnChart'), 'Disabled')]"
+          },
+          "thresholdValue25SendNotificationWhenExceeded": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue25SendNotificationWhenExceeded'), 'Disabled')]"
+          },
+          "thresholdValue50DisplayOnChart": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue50DisplayOnChart'), 'Disabled')]"
+          },
+          "thresholdValue50SendNotificationWhenExceeded": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue50SendNotificationWhenExceeded'), 'Disabled')]"
+          },
+          "thresholdValue75DisplayOnChart": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue75DisplayOnChart'), 'Disabled')]"
+          },
+          "thresholdValue75SendNotificationWhenExceeded": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue75SendNotificationWhenExceeded'), 'Disabled')]"
+          },
+          "thresholdValue100DisplayOnChart": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue100DisplayOnChart'), 'Disabled')]"
+          },
+          "thresholdValue100SendNotificationWhenExceeded": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue100SendNotificationWhenExceeded'), 'Disabled')]"
+          },
+          "thresholdValue125DisplayOnChart": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue125DisplayOnChart'), 'Disabled')]"
+          },
+          "thresholdValue125SendNotificationWhenExceeded": {
+            "value": "[coalesce(tryGet(parameters('costs'), 'thresholdValue125SendNotificationWhenExceeded'), 'Disabled')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -1365,10 +2424,10 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "16348143074487982445"
+              "templateHash": "7509251296299887127"
             },
             "name": "DevTest Lab Costs",
-            "description": "This module deploys a DevTest Lab Cost.\n\nManage lab costs by setting a spending target that can be viewed in the Monthly Estimated Cost Trend chart. DevTest Labs can send a notification when spending reaches the specified target threshold.",
+            "description": "This module deploys a DevTest Lab Cost.\r\n\r\nManage lab costs by setting a spending target that can be viewed in the Monthly Estimated Cost Trend chart. DevTest Labs can send a notification when spending reaches the specified target threshold.",
             "owner": "Azure/module-maintainers"
           },
           "parameters": {
@@ -1397,14 +2456,14 @@
             },
             "cycleStartDateTime": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Conditional. Reporting cycle start date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to \"Custom\"."
               }
             },
             "cycleEndDateTime": {
               "type": "string",
-              "defaultValue": "",
+              "nullable": true,
               "metadata": {
                 "description": "Conditional. Reporting cycle end date in the zulu time format (e.g. 2023-12-01T00:00:00.000Z). Required if cycleType is set to \"Custom\"."
               }
diff --git a/avm/res/dev-test-lab/lab/notificationchannel/README.md b/avm/res/dev-test-lab/lab/notificationchannel/README.md
index c30c17d59e..fd53ab26c2 100644
--- a/avm/res/dev-test-lab/lab/notificationchannel/README.md
+++ b/avm/res/dev-test-lab/lab/notificationchannel/README.md
@@ -69,7 +69,6 @@ The email recipient to send notifications to (can be a list of semi-colon separa
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `labName`
 
diff --git a/avm/res/dev-test-lab/lab/notificationchannel/main.bicep b/avm/res/dev-test-lab/lab/notificationchannel/main.bicep
index 2e97b66ddd..84fa6aa9f8 100644
--- a/avm/res/dev-test-lab/lab/notificationchannel/main.bicep
+++ b/avm/res/dev-test-lab/lab/notificationchannel/main.bicep
@@ -24,7 +24,7 @@ param description string = ''
 param events array = []
 
 @sys.description('Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty.')
-param emailRecipient string = ''
+param emailRecipient string?
 
 @sys.description('Conditional. The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty.')
 param webHookUrl string = ''
@@ -42,7 +42,11 @@ resource notificationChannel 'Microsoft.DevTestLab/labs/notificationchannels@201
   tags: tags
   properties: {
     description: description
-    events: events
+    events: [
+      for event in events: {
+        eventName: event
+      }
+    ]
     emailRecipient: emailRecipient
     webHookUrl: webHookUrl
     notificationLocale: notificationLocale
diff --git a/avm/res/dev-test-lab/lab/notificationchannel/main.json b/avm/res/dev-test-lab/lab/notificationchannel/main.json
index f7dbaa7d25..36963586b6 100644
--- a/avm/res/dev-test-lab/lab/notificationchannel/main.json
+++ b/avm/res/dev-test-lab/lab/notificationchannel/main.json
@@ -6,10 +6,10 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "7230564820615005386"
+      "templateHash": "95632191903979650"
     },
     "name": "DevTest Lab Notification Channels",
-    "description": "This module deploys a DevTest Lab Notification Channel.\n\nNotification channels are used by the schedule resource type in order to send notifications or events to email addresses and/or webhooks.",
+    "description": "This module deploys a DevTest Lab Notification Channel.\r\n\r\nNotification channels are used by the schedule resource type in order to send notifications or events to email addresses and/or webhooks.",
     "owner": "Azure/module-maintainers"
   },
   "parameters": {
@@ -52,7 +52,7 @@
     },
     "emailRecipient": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if \"webHookUrl\" is empty."
       }
@@ -85,8 +85,16 @@
       "name": "[format('{0}/{1}', parameters('labName'), parameters('name'))]",
       "tags": "[parameters('tags')]",
       "properties": {
+        "copy": [
+          {
+            "name": "events",
+            "count": "[length(parameters('events'))]",
+            "input": {
+              "eventName": "[parameters('events')[copyIndex('events')]]"
+            }
+          }
+        ],
         "description": "[parameters('description')]",
-        "events": "[parameters('events')]",
         "emailRecipient": "[parameters('emailRecipient')]",
         "webHookUrl": "[parameters('webHookUrl')]",
         "notificationLocale": "[parameters('notificationLocale')]"
diff --git a/avm/res/dev-test-lab/lab/policyset/policy/main.bicep b/avm/res/dev-test-lab/lab/policyset/policy/main.bicep
index c9dbe3dba8..a4a53a50c4 100644
--- a/avm/res/dev-test-lab/lab/policyset/policy/main.bicep
+++ b/avm/res/dev-test-lab/lab/policyset/policy/main.bicep
@@ -60,9 +60,9 @@ resource policy 'Microsoft.DevTestLab/labs/policysets/policies@2018-09-15' = {
   name: name
   parent: lab::policySets
   properties: {
-    description: description
+    description: description ?? ''
     evaluatorType: evaluatorType
-    factData: factData
+    factData: factData ?? ''
     factName: factName
     status: status
     threshold: threshold
diff --git a/avm/res/dev-test-lab/lab/policyset/policy/main.json b/avm/res/dev-test-lab/lab/policyset/policy/main.json
index 3a63fb4c36..35370542da 100644
--- a/avm/res/dev-test-lab/lab/policyset/policy/main.json
+++ b/avm/res/dev-test-lab/lab/policyset/policy/main.json
@@ -5,10 +5,10 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "12174587300527865958"
+      "templateHash": "10307787353498465860"
     },
     "name": "DevTest Lab Policy Sets Policies",
-    "description": "This module deploys a DevTest Lab Policy Sets Policy.\n\nDevTest lab policies are used to modify the lab settings such as only allowing certain VM Size SKUs, marketplace image types, number of VMs allowed per user and other settings.",
+    "description": "This module deploys a DevTest Lab Policy Sets Policy.\r\n\r\nDevTest lab policies are used to modify the lab settings such as only allowing certain VM Size SKUs, marketplace image types, number of VMs allowed per user and other settings.",
     "owner": "Azure/module-maintainers"
   },
   "parameters": {
@@ -90,9 +90,9 @@
       "apiVersion": "2018-09-15",
       "name": "[format('{0}/{1}/{2}', parameters('labName'), 'default', parameters('name'))]",
       "properties": {
-        "description": "[parameters('description')]",
+        "description": "[coalesce(parameters('description'), '')]",
         "evaluatorType": "[parameters('evaluatorType')]",
-        "factData": "[parameters('factData')]",
+        "factData": "[coalesce(parameters('factData'), '')]",
         "factName": "[parameters('factName')]",
         "status": "[parameters('status')]",
         "threshold": "[parameters('threshold')]"
diff --git a/avm/res/dev-test-lab/lab/schedule/README.md b/avm/res/dev-test-lab/lab/schedule/README.md
index bfde29452e..9f375ff272 100644
--- a/avm/res/dev-test-lab/lab/schedule/README.md
+++ b/avm/res/dev-test-lab/lab/schedule/README.md
@@ -37,8 +37,7 @@ Lab schedules are used to modify the settings for auto-shutdown, auto-start for
 | :-- | :-- | :-- |
 | [`dailyRecurrence`](#parameter-dailyrecurrence) | object | If the schedule will occur once each day of the week, specify the daily recurrence. |
 | [`hourlyRecurrence`](#parameter-hourlyrecurrence) | object | If the schedule will occur multiple times a day, specify the hourly recurrence. |
-| [`notificationSettingsStatus`](#parameter-notificationsettingsstatus) | string | If notifications are enabled for this schedule (i.e. Enabled, Disabled). |
-| [`notificationSettingsTimeInMinutes`](#parameter-notificationsettingstimeinminutes) | int | Time in minutes before event at which notification will be sent. Optional if "notificationSettingsStatus" is set to "Enabled". Default is 30 minutes. |
+| [`notificationSettings`](#parameter-notificationsettings) | object | The notification settings for the schedule. |
 | [`status`](#parameter-status) | string | The status of the schedule (i.e. Enabled, Disabled). |
 | [`tags`](#parameter-tags) | object | Tags of the resource. |
 | [`targetResourceId`](#parameter-targetresourceid) | string | The resource ID to which the schedule belongs. |
@@ -86,7 +85,19 @@ If the schedule will occur once each day of the week, specify the daily recurren
 
 - Required: No
 - Type: object
-- Default: `{}`
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`time`](#parameter-dailyrecurrencetime) | string | The time of day the schedule will occur. |
+
+### Parameter: `dailyRecurrence.time`
+
+The time of day the schedule will occur.
+
+- Required: Yes
+- Type: string
 
 ### Parameter: `hourlyRecurrence`
 
@@ -94,15 +105,69 @@ If the schedule will occur multiple times a day, specify the hourly recurrence.
 
 - Required: No
 - Type: object
-- Default: `{}`
 
-### Parameter: `notificationSettingsStatus`
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`minute`](#parameter-hourlyrecurrenceminute) | int | Minutes of the hour the schedule will run. |
+
+### Parameter: `hourlyRecurrence.minute`
+
+Minutes of the hour the schedule will run.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `notificationSettings`
+
+The notification settings for the schedule.
+
+- Required: No
+- Type: object
+
+**Conditional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`emailRecipient`](#parameter-notificationsettingsemailrecipient) | string | The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty. |
+| [`webHookUrl`](#parameter-notificationsettingswebhookurl) | string | The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`notificationLocale`](#parameter-notificationsettingsnotificationlocale) | string | The locale to use when sending a notification (fallback for unsupported languages is EN). |
+| [`status`](#parameter-notificationsettingsstatus) | string | If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled. |
+| [`timeInMinutes`](#parameter-notificationsettingstimeinminutes) | int | Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified. |
+
+### Parameter: `notificationSettings.emailRecipient`
+
+The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty.
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationSettings.webHookUrl`
+
+The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty.
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationSettings.notificationLocale`
+
+The locale to use when sending a notification (fallback for unsupported languages is EN).
+
+- Required: No
+- Type: string
+
+### Parameter: `notificationSettings.status`
 
-If notifications are enabled for this schedule (i.e. Enabled, Disabled).
+If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled.
 
 - Required: No
 - Type: string
-- Default: `'Disabled'`
 - Allowed:
   ```Bicep
   [
@@ -111,13 +176,12 @@ If notifications are enabled for this schedule (i.e. Enabled, Disabled).
   ]
   ```
 
-### Parameter: `notificationSettingsTimeInMinutes`
+### Parameter: `notificationSettings.timeInMinutes`
 
-Time in minutes before event at which notification will be sent. Optional if "notificationSettingsStatus" is set to "Enabled". Default is 30 minutes.
+Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified.
 
 - Required: No
 - Type: int
-- Default: `30`
 
 ### Parameter: `status`
 
@@ -147,7 +211,6 @@ The resource ID to which the schedule belongs.
 
 - Required: No
 - Type: string
-- Default: `''`
 
 ### Parameter: `timeZoneId`
 
@@ -163,7 +226,27 @@ If the schedule will occur only some days of the week, specify the weekly recurr
 
 - Required: No
 - Type: object
-- Default: `{}`
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`time`](#parameter-weeklyrecurrencetime) | string | The time of day the schedule will occur. |
+| [`weekdays`](#parameter-weeklyrecurrenceweekdays) | array | The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.). |
+
+### Parameter: `weeklyRecurrence.time`
+
+The time of day the schedule will occur.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `weeklyRecurrence.weekdays`
+
+The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.).
+
+- Required: Yes
+- Type: array
 
 ## Outputs
 
diff --git a/avm/res/dev-test-lab/lab/schedule/main.bicep b/avm/res/dev-test-lab/lab/schedule/main.bicep
index c71be08e40..fea3cc182f 100644
--- a/avm/res/dev-test-lab/lab/schedule/main.bicep
+++ b/avm/res/dev-test-lab/lab/schedule/main.bicep
@@ -25,13 +25,13 @@ param taskType string
 param tags object?
 
 @sys.description('Optional. If the schedule will occur once each day of the week, specify the daily recurrence.')
-param dailyRecurrence object = {}
+param dailyRecurrence dailyRecurrenceType
 
 @sys.description('Optional. If the schedule will occur multiple times a day, specify the hourly recurrence.')
-param hourlyRecurrence object = {}
+param hourlyRecurrence hourlyRecurrenceType
 
 @sys.description('Optional. If the schedule will occur only some days of the week, specify the weekly recurrence.')
-param weeklyRecurrence object = {}
+param weeklyRecurrence weeklyRecurrenceType
 
 @allowed([
   'Enabled'
@@ -41,20 +41,13 @@ param weeklyRecurrence object = {}
 param status string = 'Enabled'
 
 @sys.description('Optional. The resource ID to which the schedule belongs.')
-param targetResourceId string = ''
+param targetResourceId string?
 
 @sys.description('Optional. The time zone ID (e.g. Pacific Standard time).')
 param timeZoneId string = 'Pacific Standard time'
 
-@allowed([
-  'Enabled'
-  'Disabled'
-])
-@sys.description('Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled).')
-param notificationSettingsStatus string = 'Disabled'
-
-@sys.description('Optional. Time in minutes before event at which notification will be sent. Optional if "notificationSettingsStatus" is set to "Enabled". Default is 30 minutes.')
-param notificationSettingsTimeInMinutes int = 30
+@sys.description('Optional. The notification settings for the schedule.')
+param notificationSettings notificationSettingsType
 
 resource lab 'Microsoft.DevTestLab/labs@2018-09-15' existing = {
   name: labName
@@ -66,18 +59,13 @@ resource schedule 'Microsoft.DevTestLab/labs/schedules@2018-09-15' = {
   tags: tags
   properties: {
     taskType: taskType
-    dailyRecurrence: !empty(dailyRecurrence) ? dailyRecurrence : null
-    hourlyRecurrence: !empty(hourlyRecurrence) ? hourlyRecurrence : null
-    weeklyRecurrence: !empty(weeklyRecurrence) ? weeklyRecurrence : null
+    dailyRecurrence: dailyRecurrence
+    hourlyRecurrence: hourlyRecurrence
+    weeklyRecurrence: weeklyRecurrence
     status: status
-    targetResourceId: !empty(targetResourceId) ? targetResourceId : null
+    targetResourceId: targetResourceId
     timeZoneId: timeZoneId
-    notificationSettings: notificationSettingsStatus == 'Enabled'
-      ? {
-          status: notificationSettingsStatus
-          timeInMinutes: notificationSettingsTimeInMinutes
-        }
-      : {}
+    notificationSettings: notificationSettings
   }
 }
 
@@ -89,3 +77,46 @@ output resourceId string = schedule.id
 
 @sys.description('The name of the resource group the schedule was created in.')
 output resourceGroupName string = resourceGroup().name
+
+// =============== //
+//   Definitions   //
+// =============== //
+
+@export()
+type dailyRecurrenceType = {
+  @sys.description('Required. The time of day the schedule will occur.')
+  time: string
+}?
+
+@export()
+type hourlyRecurrenceType = {
+  @sys.description('Required. Minutes of the hour the schedule will run.')
+  minute: int
+}?
+
+@export()
+type weeklyRecurrenceType = {
+  @sys.description('Required. The time of day the schedule will occur.')
+  time: string
+
+  @sys.description('Required. The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.).')
+  weekdays: string[]
+}?
+
+@export()
+type notificationSettingsType = {
+  @description('Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if "webHookUrl" is empty.')
+  emailRecipient: string?
+
+  @description('Optional. The locale to use when sending a notification (fallback for unsupported languages is EN).')
+  notificationLocale: string?
+
+  @sys.description('Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled.')
+  status: 'Disabled' | 'Enabled'?
+
+  @sys.description('Optional. Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified.')
+  timeInMinutes: int?
+
+  @description('Conditional. The webhook URL to which the notification will be sent. Required if "emailRecipient" is empty.')
+  webHookUrl: string?
+}?
diff --git a/avm/res/dev-test-lab/lab/schedule/main.json b/avm/res/dev-test-lab/lab/schedule/main.json
index 7b20dd6385..2b95e09f31 100644
--- a/avm/res/dev-test-lab/lab/schedule/main.json
+++ b/avm/res/dev-test-lab/lab/schedule/main.json
@@ -6,12 +6,116 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "12081847452316418446"
+      "templateHash": "9010276477624635732"
     },
     "name": "DevTest Lab Schedules",
-    "description": "This module deploys a DevTest Lab Schedule.\n\nLab schedules are used to modify the settings for auto-shutdown, auto-start for lab virtual machines.",
+    "description": "This module deploys a DevTest Lab Schedule.\r\n\r\nLab schedules are used to modify the settings for auto-shutdown, auto-start for lab virtual machines.",
     "owner": "Azure/module-maintainers"
   },
+  "definitions": {
+    "dailyRecurrenceType": {
+      "type": "object",
+      "properties": {
+        "time": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The time of day the schedule will occur."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_export!": true
+      }
+    },
+    "hourlyRecurrenceType": {
+      "type": "object",
+      "properties": {
+        "minute": {
+          "type": "int",
+          "metadata": {
+            "description": "Required. Minutes of the hour the schedule will run."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_export!": true
+      }
+    },
+    "weeklyRecurrenceType": {
+      "type": "object",
+      "properties": {
+        "time": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The time of day the schedule will occur."
+          }
+        },
+        "weekdays": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "metadata": {
+            "description": "Required. The days of the week for which the schedule is set (e.g. Sunday, Monday, Tuesday, etc.)."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_export!": true
+      }
+    },
+    "notificationSettingsType": {
+      "type": "object",
+      "properties": {
+        "emailRecipient": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The email recipient to send notifications to (can be a list of semi-colon separated email addresses). Required if \"webHookUrl\" is empty."
+          }
+        },
+        "notificationLocale": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The locale to use when sending a notification (fallback for unsupported languages is EN)."
+          }
+        },
+        "status": {
+          "type": "string",
+          "allowedValues": [
+            "Disabled",
+            "Enabled"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled). Default is Disabled."
+          }
+        },
+        "timeInMinutes": {
+          "type": "int",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Time in minutes before event at which notification will be sent. Default is 30 minutes if status is Enabled and not specified."
+          }
+        },
+        "webHookUrl": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The webhook URL to which the notification will be sent. Required if \"emailRecipient\" is empty."
+          }
+        }
+      },
+      "nullable": true,
+      "metadata": {
+        "__bicep_export!": true
+      }
+    }
+  },
   "parameters": {
     "labName": {
       "type": "string",
@@ -47,22 +151,19 @@
       }
     },
     "dailyRecurrence": {
-      "type": "object",
-      "defaultValue": {},
+      "$ref": "#/definitions/dailyRecurrenceType",
       "metadata": {
         "description": "Optional. If the schedule will occur once each day of the week, specify the daily recurrence."
       }
     },
     "hourlyRecurrence": {
-      "type": "object",
-      "defaultValue": {},
+      "$ref": "#/definitions/hourlyRecurrenceType",
       "metadata": {
         "description": "Optional. If the schedule will occur multiple times a day, specify the hourly recurrence."
       }
     },
     "weeklyRecurrence": {
-      "type": "object",
-      "defaultValue": {},
+      "$ref": "#/definitions/weeklyRecurrenceType",
       "metadata": {
         "description": "Optional. If the schedule will occur only some days of the week, specify the weekly recurrence."
       }
@@ -80,7 +181,7 @@
     },
     "targetResourceId": {
       "type": "string",
-      "defaultValue": "",
+      "nullable": true,
       "metadata": {
         "description": "Optional. The resource ID to which the schedule belongs."
       }
@@ -92,22 +193,10 @@
         "description": "Optional. The time zone ID (e.g. Pacific Standard time)."
       }
     },
-    "notificationSettingsStatus": {
-      "type": "string",
-      "defaultValue": "Disabled",
-      "allowedValues": [
-        "Enabled",
-        "Disabled"
-      ],
-      "metadata": {
-        "description": "Optional. If notifications are enabled for this schedule (i.e. Enabled, Disabled)."
-      }
-    },
-    "notificationSettingsTimeInMinutes": {
-      "type": "int",
-      "defaultValue": 30,
+    "notificationSettings": {
+      "$ref": "#/definitions/notificationSettingsType",
       "metadata": {
-        "description": "Optional. Time in minutes before event at which notification will be sent. Optional if \"notificationSettingsStatus\" is set to \"Enabled\". Default is 30 minutes."
+        "description": "Optional. The notification settings for the schedule."
       }
     }
   },
@@ -125,13 +214,13 @@
       "tags": "[parameters('tags')]",
       "properties": {
         "taskType": "[parameters('taskType')]",
-        "dailyRecurrence": "[if(not(empty(parameters('dailyRecurrence'))), parameters('dailyRecurrence'), null())]",
-        "hourlyRecurrence": "[if(not(empty(parameters('hourlyRecurrence'))), parameters('hourlyRecurrence'), null())]",
-        "weeklyRecurrence": "[if(not(empty(parameters('weeklyRecurrence'))), parameters('weeklyRecurrence'), null())]",
+        "dailyRecurrence": "[parameters('dailyRecurrence')]",
+        "hourlyRecurrence": "[parameters('hourlyRecurrence')]",
+        "weeklyRecurrence": "[parameters('weeklyRecurrence')]",
         "status": "[parameters('status')]",
-        "targetResourceId": "[if(not(empty(parameters('targetResourceId'))), parameters('targetResourceId'), null())]",
+        "targetResourceId": "[parameters('targetResourceId')]",
         "timeZoneId": "[parameters('timeZoneId')]",
-        "notificationSettings": "[if(equals(parameters('notificationSettingsStatus'), 'Enabled'), createObject('status', parameters('notificationSettingsStatus'), 'timeInMinutes', parameters('notificationSettingsTimeInMinutes')), createObject())]"
+        "notificationSettings": "[parameters('notificationSettings')]"
       },
       "dependsOn": [
         "lab"
diff --git a/avm/res/dev-test-lab/lab/tests/e2e/max/main.test.bicep b/avm/res/dev-test-lab/lab/tests/e2e/max/main.test.bicep
index dcab1da10f..65d06f3e05 100644
--- a/avm/res/dev-test-lab/lab/tests/e2e/max/main.test.bicep
+++ b/avm/res/dev-test-lab/lab/tests/e2e/max/main.test.bicep
@@ -226,8 +226,10 @@ module testDeployment '../../../main.bicep' = [
           dailyRecurrence: {
             time: '0000'
           }
-          notificationSettingsStatus: 'Enabled'
-          notificationSettingsTimeInMinutes: 30
+          notificationSettings: {
+            status: 'Enabled'
+            timeInMinutes: 30
+          }
         }
         {
           name: 'LabVmAutoStart'
@@ -251,9 +253,7 @@ module testDeployment '../../../main.bicep' = [
           name: 'autoShutdown'
           description: 'Integration configured for auto-shutdown'
           events: [
-            {
-              eventName: 'AutoShutdown'
-            }
+            'AutoShutdown'
           ]
           emailRecipient: 'mail@contosodtlmail.com'
           webHookUrl: 'https://webhook.contosotest.com'
@@ -262,9 +262,7 @@ module testDeployment '../../../main.bicep' = [
         {
           name: 'costThreshold'
           events: [
-            {
-              eventName: 'Cost'
-            }
+            'Cost'
           ]
           webHookUrl: 'https://webhook.contosotest.com'
         }
@@ -273,10 +271,9 @@ module testDeployment '../../../main.bicep' = [
         {
           name: 'Public Repo'
           displayName: 'Public Artifact Repo'
-          status: 'Disabled'
+          status: 'Enabled'
           uri: 'https://github.com/Azure/azure-devtestlab.git'
           sourceType: 'GitHub'
-          branchRef: 'master'
           folderPath: '/Artifacts'
         }
         {
@@ -287,12 +284,28 @@ module testDeployment '../../../main.bicep' = [
           sourceType: 'GitHub'
           branchRef: 'master'
           armTemplateFolderPath: '/Environments'
+          tags: {
+            'hidden-title': 'This is visible in the resource name'
+            resourceType: 'DevTest Lab'
+            labName: '${namePrefix}${serviceShort}001'
+          }
+        }
+        {
+          name: 'Private Repo'
+          displayName: 'Private Artifact Repo'
+          status: 'Disabled'
+          uri: 'https://github.com/Azure/azure-devtestlab.git'
+          folderPath: '/Artifacts'
+          armTemplateFolderPath: '/ArmTemplates'
+          branchRef: 'main'
+          securityToken: guid(baseTime)
         }
       ]
       costs: {
         status: 'Enabled'
         cycleType: 'CalendarMonth'
         target: 450
+        currencyCode: 'AUD'
         thresholdValue100DisplayOnChart: 'Enabled'
         thresholdValue100SendNotificationWhenExceeded: 'Enabled'
       }
diff --git a/avm/res/dev-test-lab/lab/version.json b/avm/res/dev-test-lab/lab/version.json
index 1c035df49f..b3d560b1ad 100644
--- a/avm/res/dev-test-lab/lab/version.json
+++ b/avm/res/dev-test-lab/lab/version.json
@@ -1,7 +1,7 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.2",
+    "version": "0.3",
     "pathFilters": [
         "./main.json"
     ]
-}
\ No newline at end of file
+}
diff --git a/avm/res/dev-test-lab/lab/virtualnetwork/main.bicep b/avm/res/dev-test-lab/lab/virtualnetwork/main.bicep
index b73bab89b6..07e8f88432 100644
--- a/avm/res/dev-test-lab/lab/virtualnetwork/main.bicep
+++ b/avm/res/dev-test-lab/lab/virtualnetwork/main.bicep
@@ -49,3 +49,49 @@ output resourceId string = virtualNetwork.id
 
 @sys.description('The name of the resource group the lab virtual network was created in.')
 output resourceGroupName string = resourceGroup().name
+
+// =============== //
+//   Definitions   //
+// =============== //
+
+@export()
+type allowedSubnetType = {
+  @sys.description('Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny)).')
+  allowPublicIp: 'Allow' | 'Deny' | 'Default'?
+
+  @sys.description('Required. The resource ID of the allowed subnet.')
+  resourceId: string
+
+  @sys.description('Required. The name of the subnet as seen in the lab.')
+  labSubnetName: string
+}
+
+@export()
+type subnetOverrideType = {
+  @sys.description('Required. The name given to the subnet within the lab.')
+  labSubnetName: string
+
+  @sys.description('Required. The resource ID of the subnet.')
+  resourceId: string
+
+  @sys.description('Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny)).')
+  sharedPublicIpAddressConfiguration: {
+    @sys.description('Required. Backend ports that virtual machines on this subnet are allowed to expose.')
+    allowedPorts: {
+      @sys.description('Required. Backend port of the target virtual machine.')
+      backendPort: int
+
+      @sys.description('Required. Protocol type of the port.')
+      transportProtocol: 'Tcp' | 'Udp'
+    }[]
+  }
+
+  @sys.description('Optional. Indicates whether this subnet can be used during virtual machine creation (i.e. Allow, Deny).')
+  useInVmCreationPermission: 'Allow' | 'Deny' | 'Default'?
+
+  @sys.description('Optional. Indicates whether public IP addresses can be assigned to virtual machines on this subnet (i.e. Allow, Deny).')
+  usePublicIpAddressPermission: 'Allow' | 'Deny' | 'Default'?
+
+  @sys.description('Optional. The virtual network pool associated with this subnet.')
+  virtualNetworkPoolName: string?
+}
diff --git a/avm/res/dev-test-lab/lab/virtualnetwork/main.json b/avm/res/dev-test-lab/lab/virtualnetwork/main.json
index 608e44f7a1..1eab7d68eb 100644
--- a/avm/res/dev-test-lab/lab/virtualnetwork/main.json
+++ b/avm/res/dev-test-lab/lab/virtualnetwork/main.json
@@ -6,12 +6,132 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "1030641179919111475"
+      "templateHash": "18309816581107210302"
     },
     "name": "DevTest Lab Virtual Networks",
-    "description": "This module deploys a DevTest Lab Virtual Network.\n\nLab virtual machines must be deployed into a virtual network. This resource type allows configuring the virtual network and subnet settings used for the lab virtual machines.",
+    "description": "This module deploys a DevTest Lab Virtual Network.\r\n\r\nLab virtual machines must be deployed into a virtual network. This resource type allows configuring the virtual network and subnet settings used for the lab virtual machines.",
     "owner": "Azure/module-maintainers"
   },
+  "definitions": {
+    "allowedSubnetType": {
+      "type": "object",
+      "properties": {
+        "allowPublicIp": {
+          "type": "string",
+          "allowedValues": [
+            "Allow",
+            "Default",
+            "Deny"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny))."
+          }
+        },
+        "resourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The resource ID of the allowed subnet."
+          }
+        },
+        "labSubnetName": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name of the subnet as seen in the lab."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true
+      }
+    },
+    "subnetOverrideType": {
+      "type": "object",
+      "properties": {
+        "labSubnetName": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name given to the subnet within the lab."
+          }
+        },
+        "resourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The resource ID of the subnet."
+          }
+        },
+        "sharedPublicIpAddressConfiguration": {
+          "type": "object",
+          "properties": {
+            "allowedPorts": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "backendPort": {
+                    "type": "int",
+                    "metadata": {
+                      "description": "Required. Backend port of the target virtual machine."
+                    }
+                  },
+                  "transportProtocol": {
+                    "type": "string",
+                    "allowedValues": [
+                      "Tcp",
+                      "Udp"
+                    ],
+                    "metadata": {
+                      "description": "Required. Protocol type of the port."
+                    }
+                  }
+                }
+              },
+              "metadata": {
+                "description": "Required. Backend ports that virtual machines on this subnet are allowed to expose."
+              }
+            }
+          },
+          "metadata": {
+            "description": "Optional. The permission policy of the subnet for allowing public IP addresses (i.e. Allow, Deny))."
+          }
+        },
+        "useInVmCreationPermission": {
+          "type": "string",
+          "allowedValues": [
+            "Allow",
+            "Default",
+            "Deny"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Indicates whether this subnet can be used during virtual machine creation (i.e. Allow, Deny)."
+          }
+        },
+        "usePublicIpAddressPermission": {
+          "type": "string",
+          "allowedValues": [
+            "Allow",
+            "Default",
+            "Deny"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Indicates whether public IP addresses can be assigned to virtual machines on this subnet (i.e. Allow, Deny)."
+          }
+        },
+        "virtualNetworkPoolName": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The virtual network pool associated with this subnet."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true
+      }
+    }
+  },
   "parameters": {
     "labName": {
       "type": "string",
diff --git a/avm/res/digital-twins/digital-twins-instance/endpoint--event-grid/README.md b/avm/res/digital-twins/digital-twins-instance/endpoint--event-grid/README.md
index ce6c8cce8e..d4147f7508 100644
--- a/avm/res/digital-twins/digital-twins-instance/endpoint--event-grid/README.md
+++ b/avm/res/digital-twins/digital-twins-instance/endpoint--event-grid/README.md
@@ -7,7 +7,6 @@ This module deploys a Digital Twins Instance Event Grid Endpoint.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -90,10 +89,3 @@ The name of the Digital Twin Endpoint.
 | `name` | string | The name of the Endpoint. |
 | `resourceGroupName` | string | The name of the resource group the resource was created in. |
 | `resourceId` | string | The resource ID of the Endpoint. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/digital-twins/digital-twins-instance/endpoint--event-hub/README.md b/avm/res/digital-twins/digital-twins-instance/endpoint--event-hub/README.md
index 256b90551f..991679f17e 100644
--- a/avm/res/digital-twins/digital-twins-instance/endpoint--event-hub/README.md
+++ b/avm/res/digital-twins/digital-twins-instance/endpoint--event-hub/README.md
@@ -7,7 +7,6 @@ This module deploys a Digital Twins Instance EventHub Endpoint.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -151,10 +150,3 @@ The name of the Digital Twin Endpoint.
 | `resourceGroupName` | string | The name of the resource group the resource was created in. |
 | `resourceId` | string | The resource ID of the Endpoint. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. Note: As of 2024-03 is not exported by API. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/digital-twins/digital-twins-instance/endpoint--service-bus/README.md b/avm/res/digital-twins/digital-twins-instance/endpoint--service-bus/README.md
index 2bc0af27f6..94bb4dcd6d 100644
--- a/avm/res/digital-twins/digital-twins-instance/endpoint--service-bus/README.md
+++ b/avm/res/digital-twins/digital-twins-instance/endpoint--service-bus/README.md
@@ -7,7 +7,6 @@ This module deploys a Digital Twins Instance ServiceBus Endpoint.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -152,9 +151,3 @@ SecondaryConnectionString of the endpoint for key-based authentication. Will be
 | `resourceId` | string | The resource ID of the Endpoint. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. Note: As of 2024-03 is not exported by API. |
 
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/document-db/database-account/README.md b/avm/res/document-db/database-account/README.md
index c58df1008a..24654fcc7f 100644
--- a/avm/res/document-db/database-account/README.md
+++ b/avm/res/document-db/database-account/README.md
@@ -3785,6 +3785,7 @@ Tags of the Database Account resource.
 | `exportedSecrets` |  | The references to the secrets exported to the provided Key Vault. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the database account. |
+| `privateEndpoints` | array | The private endpoints of the database account. |
 | `resourceGroupName` | string | The name of the resource group the database account was created in. |
 | `resourceId` | string | The resource ID of the database account. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -3795,7 +3796,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.7.0` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/document-db/database-account/main.bicep b/avm/res/document-db/database-account/main.bicep
index 72b4c5e117..bde70c52ef 100644
--- a/avm/res/document-db/database-account/main.bicep
+++ b/avm/res/document-db/database-account/main.bicep
@@ -463,7 +463,7 @@ module databaseAccount_gremlinDatabases 'gremlin-database/main.bicep' = [
   }
 ]
 
-module databaseAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.0' = [
+module databaseAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-databaseAccount-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -616,6 +616,17 @@ output location string = databaseAccount.location
 @description('The endpoint of the database account.')
 output endpoint string = databaseAccount.properties.documentEndpoint
 
+@description('The private endpoints of the database account.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: databaseAccount_privateEndpoints[i].outputs.name
+    resourceId: databaseAccount_privateEndpoints[i].outputs.resourceId
+    groupId: databaseAccount_privateEndpoints[i].outputs.groupId
+    customDnsConfig: databaseAccount_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: databaseAccount_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
diff --git a/avm/res/document-db/database-account/main.json b/avm/res/document-db/database-account/main.json
index 875d7f835a..b09e8f067f 100644
--- a/avm/res/document-db/database-account/main.json
+++ b/avm/res/document-db/database-account/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "8262521971858161152"
+      "templateHash": "17113672202913052529"
     },
     "name": "DocumentDB Database Accounts",
     "description": "This module deploys a DocumentDB Database Account.",
@@ -2658,7 +2658,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "3308873178893851812"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
@@ -3080,7 +3080,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -3341,6 +3341,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -3539,6 +3546,22 @@
         "description": "The endpoint of the database account."
       },
       "value": "[reference('databaseAccount').documentEndpoint]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the database account."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/event-grid/domain/README.md b/avm/res/event-grid/domain/README.md
index a3eec41c35..7514b32c3d 100644
--- a/avm/res/event-grid/domain/README.md
+++ b/avm/res/event-grid/domain/README.md
@@ -126,9 +126,13 @@ module domain 'br/public:avm/res/event-grid/domain:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -137,9 +141,13 @@ module domain 'br/public:avm/res/event-grid/domain:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -227,9 +235,13 @@ module domain 'br/public:avm/res/event-grid/domain:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -238,9 +250,13 @@ module domain 'br/public:avm/res/event-grid/domain:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -323,9 +339,13 @@ module domain 'br/public:avm/res/event-grid/domain:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'domain'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -395,9 +415,13 @@ module domain 'br/public:avm/res/event-grid/domain:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "domain",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -746,8 +770,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -931,19 +954,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1203,6 +1271,7 @@ The topic names which are associated with the domain.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the event grid domain. |
+| `privateEndpoints` | array | The private endpoints of the event grid domain. |
 | `resourceGroupName` | string | The name of the resource group the event grid domain was deployed into. |
 | `resourceId` | string | The resource ID of the event grid domain. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1213,7 +1282,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/event-grid/domain/main.bicep b/avm/res/event-grid/domain/main.bicep
index 621a326169..5c6faac2cc 100644
--- a/avm/res/event-grid/domain/main.bicep
+++ b/avm/res/event-grid/domain/main.bicep
@@ -196,7 +196,7 @@ resource domain_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-0
   }
 ]
 
-module domain_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module domain_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-domain-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -237,8 +237,7 @@ module domain_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -280,6 +279,17 @@ output location string = domain.location
 @description('The principal ID of the system assigned identity.')
 output systemAssignedMIPrincipalId string = domain.?identity.?principalId ?? ''
 
+@description('The private endpoints of the event grid domain.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: domain_privateEndpoints[i].outputs.name
+    resourceId: domain_privateEndpoints[i].outputs.resourceId
+    groupId: domain_privateEndpoints[i].outputs.groupId
+    customDnsConfig: domain_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: domain_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -342,11 +352,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/event-grid/domain/main.json b/avm/res/event-grid/domain/main.json
index 895510e65a..3c794e8617 100644
--- a/avm/res/event-grid/domain/main.json
+++ b/avm/res/event-grid/domain/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "4793397207641281137"
+      "templateHash": "15360544071637596011"
     },
     "name": "Event Grid Domains",
     "description": "This module deploys an Event Grid Domain.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -809,11 +832,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -842,13 +862,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1100,6 +1141,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1135,18 +1199,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1227,7 +1284,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1306,7 +1363,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1317,28 +1374,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1346,12 +1427,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1365,27 +1449,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1452,6 +1545,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1502,6 +1602,22 @@
         "description": "The principal ID of the system assigned identity."
       },
       "value": "[coalesce(tryGet(tryGet(reference('domain', '2023-06-01-preview', 'full'), 'identity'), 'principalId'), '')]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the event grid domain."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('domain_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('domain_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('domain_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('domain_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('domain_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/event-grid/domain/tests/e2e/max/main.test.bicep b/avm/res/event-grid/domain/tests/e2e/max/main.test.bicep
index 904a2b28a3..260afa0d4a 100644
--- a/avm/res/event-grid/domain/tests/e2e/max/main.test.bicep
+++ b/avm/res/event-grid/domain/tests/e2e/max/main.test.bicep
@@ -93,9 +93,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -104,9 +108,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/event-grid/domain/tests/e2e/waf-aligned/main.test.bicep b/avm/res/event-grid/domain/tests/e2e/waf-aligned/main.test.bicep
index 6f5ed2bdbd..5c9ac482a6 100644
--- a/avm/res/event-grid/domain/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/event-grid/domain/tests/e2e/waf-aligned/main.test.bicep
@@ -87,9 +87,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'domain'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/event-grid/domain/version.json b/avm/res/event-grid/domain/version.json
index 13669e6601..ea4f3b6e67 100644
--- a/avm/res/event-grid/domain/version.json
+++ b/avm/res/event-grid/domain/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.4",
+  "version": "0.5",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/res/event-grid/namespace/README.md b/avm/res/event-grid/namespace/README.md
index 0990ba17e5..290a4d6631 100644
--- a/avm/res/event-grid/namespace/README.md
+++ b/avm/res/event-grid/namespace/README.md
@@ -134,9 +134,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -145,9 +149,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -339,9 +347,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -350,9 +362,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -1200,9 +1216,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
     location: '<location>'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -1211,9 +1231,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -1276,9 +1300,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -1287,9 +1315,13 @@ module namespace 'br/public:avm/res/event-grid/namespace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -1709,10 +1741,9 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`isManualConnection`](#parameter-privateendpointsismanualconnection) | bool | If Manual Private Link Connection is required. |
 | [`location`](#parameter-privateendpointslocation) | string | The location to deploy the private endpoint to. |
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
-| [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. Restricted to 140 chars. |
+| [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1884,7 +1915,7 @@ Specify the name of lock.
 
 ### Parameter: `privateEndpoints.manualConnectionRequestMessage`
 
-A message passed to the owner of the remote resource with the manual connection request. Restricted to 140 chars.
+A message passed to the owner of the remote resource with the manual connection request.
 
 - Required: No
 - Type: string
@@ -1896,19 +1927,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -2203,6 +2279,7 @@ Indicates if Topic Spaces Configuration is enabled for the namespace. This enabl
 | :-- | :-- | :-- |
 | `location` | string | The location the EventGrid Namespace was deployed into. |
 | `name` | string | The name of the EventGrid Namespace. |
+| `privateEndpoints` | array | The private endpoints of the EventGrid Namespace. |
 | `resourceGroupName` | string | The name of the resource group the EventGrid Namespace was created in. |
 | `resourceId` | string | The resource ID of the EventGrid Namespace. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -2214,7 +2291,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/event-grid/namespace/main.bicep b/avm/res/event-grid/namespace/main.bicep
index 2cbe4b06cd..29c68aeddc 100644
--- a/avm/res/event-grid/namespace/main.bicep
+++ b/avm/res/event-grid/namespace/main.bicep
@@ -268,7 +268,7 @@ resource namespace_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@202
   }
 ]
 
-module namespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module namespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-namespace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -309,8 +309,7 @@ module namespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -447,6 +446,17 @@ output topicResourceIds array = [
   for index in range(0, length(topics ?? [])): namespace_topics[index].outputs.resourceId
 ]
 
+@description('The private endpoints of the EventGrid Namespace.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: namespace_privateEndpoints[i].outputs.name
+    resourceId: namespace_privateEndpoints[i].outputs.resourceId
+    groupId: namespace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: namespace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: namespace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // ================ //
 // Definitions      //
 // ================ //
@@ -509,16 +519,26 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
 
-  @description('Optional. A message passed to the owner of the remote resource with the manual connection request. Restricted to 140 chars.')
+  @description('Optional. A message passed to the owner of the remote resource with the manual connection request.')
+  @maxLength(140)
   manualConnectionRequestMessage: string?
 
   @description('Optional. Custom DNS configurations.')
diff --git a/avm/res/event-grid/namespace/main.json b/avm/res/event-grid/namespace/main.json
index c0ecaa4627..740f8c02be 100644
--- a/avm/res/event-grid/namespace/main.json
+++ b/avm/res/event-grid/namespace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "6471801144579320017"
+      "templateHash": "12641353733245664102"
     },
     "name": "Event Grid Namespaces",
     "description": "This module deploys an Event Grid Namespace.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -200,8 +223,9 @@
           "manualConnectionRequestMessage": {
             "type": "string",
             "nullable": true,
+            "maxLength": 140,
             "metadata": {
-              "description": "Optional. A message passed to the owner of the remote resource with the manual connection request. Restricted to 140 chars."
+              "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
             }
           },
           "customDnsConfigs": {
@@ -814,11 +838,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -847,13 +868,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1105,6 +1147,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1140,18 +1205,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1232,7 +1290,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1311,7 +1369,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1322,28 +1380,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1351,12 +1433,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1370,27 +1455,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1457,6 +1551,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2918,6 +3019,22 @@
         "count": "[length(range(0, length(coalesce(parameters('topics'), createArray()))))]",
         "input": "[reference(format('namespace_topics[{0}]', range(0, length(coalesce(parameters('topics'), createArray())))[copyIndex()])).outputs.resourceId.value]"
       }
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the EventGrid Namespace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/event-grid/namespace/tests/e2e/max/main.test.bicep b/avm/res/event-grid/namespace/tests/e2e/max/main.test.bicep
index 9409e83f58..53ac497b38 100644
--- a/avm/res/event-grid/namespace/tests/e2e/max/main.test.bicep
+++ b/avm/res/event-grid/namespace/tests/e2e/max/main.test.bicep
@@ -96,9 +96,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -107,9 +111,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       roleAssignments: [
diff --git a/avm/res/event-grid/namespace/tests/e2e/waf-aligned/main.test.bicep b/avm/res/event-grid/namespace/tests/e2e/waf-aligned/main.test.bicep
index a7f5df77a0..c91a4e4ab4 100644
--- a/avm/res/event-grid/namespace/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/event-grid/namespace/tests/e2e/waf-aligned/main.test.bicep
@@ -78,9 +78,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -89,9 +93,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       roleAssignments: [
diff --git a/avm/res/event-grid/namespace/version.json b/avm/res/event-grid/namespace/version.json
index 76049e1c4a..13669e6601 100644
--- a/avm/res/event-grid/namespace/version.json
+++ b/avm/res/event-grid/namespace/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.3",
+  "version": "0.4",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/res/event-grid/topic/README.md b/avm/res/event-grid/topic/README.md
index e8aab69880..56864ec710 100644
--- a/avm/res/event-grid/topic/README.md
+++ b/avm/res/event-grid/topic/README.md
@@ -149,9 +149,13 @@ module topic 'br/public:avm/res/event-grid/topic:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             principalId: '<principalId>'
@@ -172,9 +176,13 @@ module topic 'br/public:avm/res/event-grid/topic:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -284,9 +292,13 @@ module topic 'br/public:avm/res/event-grid/topic:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "principalId": "<principalId>",
@@ -307,9 +319,13 @@ module topic 'br/public:avm/res/event-grid/topic:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -410,9 +426,13 @@ module topic 'br/public:avm/res/event-grid/topic:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'topic'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -504,9 +524,13 @@ module topic 'br/public:avm/res/event-grid/topic:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "topic",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -840,8 +864,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1025,19 +1048,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1290,6 +1358,7 @@ Tags of the resource.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the event grid topic. |
+| `privateEndpoints` | array | The private endpoints of the event grid topic. |
 | `resourceGroupName` | string | The name of the resource group the event grid topic was deployed into. |
 | `resourceId` | string | The resource ID of the event grid topic. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1300,7 +1369,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/event-grid/topic/main.bicep b/avm/res/event-grid/topic/main.bicep
index 94093016f7..400d3c498b 100644
--- a/avm/res/event-grid/topic/main.bicep
+++ b/avm/res/event-grid/topic/main.bicep
@@ -206,7 +206,7 @@ resource topic_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05
   }
 ]
 
-module topic_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module topic_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-topic-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -247,8 +247,7 @@ module topic_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -290,6 +289,17 @@ output location string = topic.location
 @description('The principal ID of the system assigned identity.')
 output systemAssignedMIPrincipalId string = topic.?identity.?principalId ?? ''
 
+@description('The private endpoints of the event grid topic.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: topic_privateEndpoints[i].outputs.name
+    resourceId: topic_privateEndpoints[i].outputs.resourceId
+    groupId: topic_privateEndpoints[i].outputs.groupId
+    customDnsConfig: topic_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: topic_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -352,11 +362,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/event-grid/topic/main.json b/avm/res/event-grid/topic/main.json
index 084eaf924c..8e1ca6e46e 100644
--- a/avm/res/event-grid/topic/main.json
+++ b/avm/res/event-grid/topic/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "4066402322456313078"
+      "templateHash": "14857992424143462934"
     },
     "name": "Event Grid Topics",
     "description": "This module deploys an Event Grid Topic.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -890,11 +913,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -923,13 +943,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1181,6 +1222,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1216,18 +1280,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1308,7 +1365,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1387,7 +1444,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1398,28 +1455,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1427,12 +1508,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1446,27 +1530,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1533,6 +1626,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1583,6 +1683,22 @@
         "description": "The principal ID of the system assigned identity."
       },
       "value": "[coalesce(tryGet(tryGet(reference('topic', '2021-06-01-preview', 'full'), 'identity'), 'principalId'), '')]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the event grid topic."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('topic_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('topic_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('topic_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('topic_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('topic_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/event-grid/topic/tests/e2e/max/main.test.bicep b/avm/res/event-grid/topic/tests/e2e/max/main.test.bicep
index bd5610cf70..d68984a6c2 100644
--- a/avm/res/event-grid/topic/tests/e2e/max/main.test.bicep
+++ b/avm/res/event-grid/topic/tests/e2e/max/main.test.bicep
@@ -118,9 +118,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           roleAssignments: [
             {
@@ -144,9 +148,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/event-grid/topic/tests/e2e/waf-aligned/main.test.bicep b/avm/res/event-grid/topic/tests/e2e/waf-aligned/main.test.bicep
index aec73401ac..b3ffdf3c21 100644
--- a/avm/res/event-grid/topic/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/event-grid/topic/tests/e2e/waf-aligned/main.test.bicep
@@ -113,9 +113,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'topic'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/event-grid/topic/version.json b/avm/res/event-grid/topic/version.json
index 13669e6601..ea4f3b6e67 100644
--- a/avm/res/event-grid/topic/version.json
+++ b/avm/res/event-grid/topic/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.4",
+  "version": "0.5",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/res/event-hub/namespace/README.md b/avm/res/event-hub/namespace/README.md
index 9eada43962..4612f1574f 100644
--- a/avm/res/event-hub/namespace/README.md
+++ b/avm/res/event-hub/namespace/README.md
@@ -317,9 +317,13 @@ module namespace 'br/public:avm/res/event-hub/namespace:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'namespace'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -533,9 +537,13 @@ module namespace 'br/public:avm/res/event-hub/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "namespace",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -714,9 +722,13 @@ module namespace 'br/public:avm/res/event-hub/namespace:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -733,7 +745,6 @@ module namespace 'br/public:avm/res/event-hub/namespace:<version>' = {
       'hidden-title': 'This is visible in the resource name'
       Role: 'DeploymentValidation'
     }
-    zoneRedundant: true
   }
 }
 ```
@@ -881,9 +892,13 @@ module namespace 'br/public:avm/res/event-hub/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -908,9 +923,6 @@ module namespace 'br/public:avm/res/event-hub/namespace:<version>' = {
         "hidden-title": "This is visible in the resource name",
         "Role": "DeploymentValidation"
       }
-    },
-    "zoneRedundant": {
-      "value": true
     }
   }
 }
@@ -1356,8 +1368,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1541,19 +1552,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1839,7 +1895,6 @@ Switch to make the Event Hub Namespace zone redundant.
 
 - Required: No
 - Type: bool
-- Default: `False`
 
 ## Outputs
 
@@ -1848,6 +1903,7 @@ Switch to make the Event Hub Namespace zone redundant.
 | `eventHubResourceIds` | array | The Resources IDs of the EventHubs within this eventspace. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the eventspace. |
+| `privateEndpoints` | array | The private endpoints of the eventspace. |
 | `resourceGroupName` | string | The resource group where the namespace is deployed. |
 | `resourceId` | string | The resource ID of the eventspace. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1858,7 +1914,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/event-hub/namespace/main.bicep b/avm/res/event-hub/namespace/main.bicep
index eb4a8787d1..bc225dd8af 100644
--- a/avm/res/event-hub/namespace/main.bicep
+++ b/avm/res/event-hub/namespace/main.bicep
@@ -23,7 +23,7 @@ param skuName string = 'Standard'
 param skuCapacity int = 1
 
 @description('Optional. Switch to make the Event Hub Namespace zone redundant.')
-param zoneRedundant bool = false
+param zoneRedundant bool = true
 
 @description('Optional. Switch to enable the Auto Inflate feature of Event Hub. Auto Inflate is not supported in Premium SKU EventHub.')
 param isAutoInflateEnabled bool = false
@@ -349,7 +349,7 @@ module eventHubNamespace_networkRuleSet 'network-rule-set/main.bicep' = if (!emp
   }
 }
 
-module eventHubNamespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module eventHubNamespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-eventHubNamespace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -390,8 +390,7 @@ module eventHubNamespace_privateEndpoints 'br/public:avm/res/network/private-end
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -482,6 +481,17 @@ output eventHubResourceIds array = [
   for index in range(0, length(eventhubs ?? [])): eventHubNamespace_eventhubs[index].outputs.resourceId
 ]
 
+@description('The private endpoints of the eventspace.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: eventHubNamespace_privateEndpoints[i].outputs.name
+    resourceId: eventHubNamespace_privateEndpoints[i].outputs.resourceId
+    groupId: eventHubNamespace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: eventHubNamespace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: eventHubNamespace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -544,11 +554,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/event-hub/namespace/main.json b/avm/res/event-hub/namespace/main.json
index dc52e9b105..7856e8e980 100644
--- a/avm/res/event-hub/namespace/main.json
+++ b/avm/res/event-hub/namespace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "6513191517073559510"
+      "templateHash": "3566282798641159484"
     },
     "name": "Event Hub Namespaces",
     "description": "This module deploys an Event Hub Namespace.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -522,7 +545,7 @@
     },
     "zoneRedundant": {
       "type": "bool",
-      "defaultValue": false,
+      "defaultValue": true,
       "metadata": {
         "description": "Optional. Switch to make the Event Hub Namespace zone redundant."
       }
@@ -1912,11 +1935,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1945,13 +1965,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -2203,6 +2244,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2238,18 +2302,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2330,7 +2387,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2409,7 +2466,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2420,28 +2477,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2449,12 +2530,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2468,27 +2552,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2555,6 +2648,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2615,6 +2715,22 @@
         "count": "[length(range(0, length(coalesce(parameters('eventhubs'), createArray()))))]",
         "input": "[reference(format('eventHubNamespace_eventhubs[{0}]', range(0, length(coalesce(parameters('eventhubs'), createArray())))[copyIndex()])).outputs.resourceId.value]"
       }
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the eventspace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('eventHubNamespace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('eventHubNamespace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('eventHubNamespace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('eventHubNamespace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('eventHubNamespace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/event-hub/namespace/tests/e2e/max/main.test.bicep b/avm/res/event-hub/namespace/tests/e2e/max/main.test.bicep
index 8f4bc0e299..4c8d619668 100644
--- a/avm/res/event-hub/namespace/tests/e2e/max/main.test.bicep
+++ b/avm/res/event-hub/namespace/tests/e2e/max/main.test.bicep
@@ -187,9 +187,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'namespace'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/event-hub/namespace/tests/e2e/waf-aligned/main.test.bicep b/avm/res/event-hub/namespace/tests/e2e/waf-aligned/main.test.bicep
index cf65bb6f5e..b4f8c06a13 100644
--- a/avm/res/event-hub/namespace/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/event-hub/namespace/tests/e2e/waf-aligned/main.test.bicep
@@ -65,7 +65,6 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      zoneRedundant: true
       skuName: 'Standard'
       skuCapacity: 2
       authorizationRules: [
@@ -167,9 +166,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
diff --git a/avm/res/event-hub/namespace/version.json b/avm/res/event-hub/namespace/version.json
index 3f863a2bec..e42c3d9e5f 100644
--- a/avm/res/event-hub/namespace/version.json
+++ b/avm/res/event-hub/namespace/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.4",
+    "version": "0.6",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/insights/component/main.bicep b/avm/res/insights/component/main.bicep
index 764ddea591..a7a3c60dca 100644
--- a/avm/res/insights/component/main.bicep
+++ b/avm/res/insights/component/main.bicep
@@ -82,7 +82,7 @@ var builtInRoleNames = {
   Contributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
   Owner: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')
   Reader: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
-  'Role Based Access Control Administrator (Preview)': subscriptionResourceId(
+  'Role Based Access Control Administrator': subscriptionResourceId(
     'Microsoft.Authorization/roleDefinitions',
     'f58310d9-a9f6-439a-9e8d-f62e7b41a168'
   )
@@ -90,6 +90,22 @@ var builtInRoleNames = {
     'Microsoft.Authorization/roleDefinitions',
     '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9'
   )
+  'Monitoring Metrics Publisher': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    '3913510d-42f4-4e42-8a64-420c390055eb'
+  )
+  'Application Insights Component Contributor': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    'ae349356-3a1b-4a5e-921d-050484c6347e'
+  )
+  'Application Insights Snapshot Debugger': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    '08954f03-6346-4c2e-81c0-ec3a5cfae23b'
+  )
+  'Monitoring Contributor': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    '749f88d5-cbae-40b8-bcfc-e573ddc772fa'
+  )
 }
 
 var formattedRoleAssignments = [
diff --git a/avm/res/insights/component/main.json b/avm/res/insights/component/main.json
index 046fb51a09..f7b9e3a933 100644
--- a/avm/res/insights/component/main.json
+++ b/avm/res/insights/component/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "4240320101610363383"
+      "templateHash": "707617228684994883"
     },
     "name": "Application Insights",
     "description": "This component deploys an Application Insights instance.",
@@ -361,8 +361,12 @@
       "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
       "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
       "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+      "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+      "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
+      "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
+      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
     }
   },
   "resources": {
diff --git a/avm/res/insights/data-collection-endpoint/README.md b/avm/res/insights/data-collection-endpoint/README.md
index e3988d2d5b..a1cd20427a 100644
--- a/avm/res/insights/data-collection-endpoint/README.md
+++ b/avm/res/insights/data-collection-endpoint/README.md
@@ -16,7 +16,7 @@ This module deploys a Data Collection Endpoint.
 | :-- | :-- |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.Insights/dataCollectionEndpoints` | [2023-03-11](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/dataCollectionEndpoints) |
+| `Microsoft.Insights/dataCollectionEndpoints` | [2023-03-11](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2023-03-11/dataCollectionEndpoints) |
 
 ## Usage examples
 
diff --git a/avm/res/insights/data-collection-rule/README.md b/avm/res/insights/data-collection-rule/README.md
index e4004accec..3c10e569c9 100644
--- a/avm/res/insights/data-collection-rule/README.md
+++ b/avm/res/insights/data-collection-rule/README.md
@@ -16,7 +16,7 @@ This module deploys a Data Collection Rule.
 | :-- | :-- |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.Insights/dataCollectionRules` | [2021-09-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-09-01-preview/dataCollectionRules) |
+| `Microsoft.Insights/dataCollectionRules` | [2023-03-11](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2023-03-11/dataCollectionRules) |
 
 ## Usage examples
 
@@ -26,18 +26,19 @@ The following section provides usage examples for the module, which were used to
 
 >**Note**: To reference the module, please use the following syntax `br/public:avm/res/insights/data-collection-rule:<version>`.
 
-- [Collecting custom text logs with ingestion-time transformation](#example-1-collecting-custom-text-logs-with-ingestion-time-transformation)
-- [Collecting custom text logs](#example-2-collecting-custom-text-logs)
-- [Collecting IIS logs](#example-3-collecting-iis-logs)
-- [Using only defaults](#example-4-using-only-defaults)
-- [Collecting Linux-specific information](#example-5-collecting-linux-specific-information)
-- [Using large parameter set](#example-6-using-large-parameter-set)
-- [WAF-aligned](#example-7-waf-aligned)
-- [Collecting Windows-specific information](#example-8-collecting-windows-specific-information)
+- [Agent Settings](#example-1-agent-settings)
+- [Collecting custom text logs with ingestion-time transformation](#example-2-collecting-custom-text-logs-with-ingestion-time-transformation)
+- [Collecting custom text logs](#example-3-collecting-custom-text-logs)
+- [Collecting IIS logs](#example-4-collecting-iis-logs)
+- [Using only defaults](#example-5-using-only-defaults)
+- [Collecting Linux-specific information](#example-6-collecting-linux-specific-information)
+- [Using large parameter set](#example-7-using-large-parameter-set)
+- [WAF-aligned](#example-8-waf-aligned)
+- [Collecting Windows-specific information](#example-9-collecting-windows-specific-information)
 
-### Example 1: _Collecting custom text logs with ingestion-time transformation_
+### Example 1: _Agent Settings_
 
-This instance deploys the module to setup collection of custom logs and ingestion-time transformation.
+This instance deploys the module AMA (Azure Monitor Agent) Settings DCR.
 
 
 <details>
@@ -49,82 +50,158 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        outputStream: 'Custom-CustomTableAdvanced_CL'
-        streams: [
-          'Custom-CustomTableAdvanced_CL'
+    dataCollectionRuleProperties: {
+      agentSettings: {
+        logs: [
+          {
+            name: 'MaxDiskQuotaInMB'
+            value: '5000'
+          }
         ]
-        transformKql: 'source | extend LogFields = split(RawData, \',\') | extend EventTime = todatetime(LogFields[0]) | extend EventLevel = tostring(LogFields[1]) | extend EventCode = toint(LogFields[2]) | extend Message = tostring(LogFields[3]) | project TimeGenerated, EventTime, EventLevel, EventCode, Message'
       }
-    ]
-    dataSources: {
-      logFiles: [
+      description: 'Agent Settings'
+      kind: 'AgentSettings'
+    }
+    name: 'idcrags001'
+    // Non-required parameters
+    location: '<location>'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "dataCollectionRuleProperties": {
+      "value": {
+        "agentSettings": {
+          "logs": [
+            {
+              "name": "MaxDiskQuotaInMB",
+              "value": "5000"
+            }
+          ]
+        },
+        "description": "Agent Settings",
+        "kind": "AgentSettings"
+      }
+    },
+    "name": {
+      "value": "idcrags001"
+    },
+    // Non-required parameters
+    "location": {
+      "value": "<location>"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 2: _Collecting custom text logs with ingestion-time transformation_
+
+This instance deploys the module to setup collection of custom logs and ingestion-time transformation.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<version>' = {
+  name: 'dataCollectionRuleDeployment'
+  params: {
+    // Required parameters
+    dataCollectionRuleProperties: {
+      dataCollectionEndpointResourceId: '<dataCollectionEndpointResourceId>'
+      dataFlows: [
         {
-          filePatterns: [
-            'C:\\TestLogsAdvanced\\TestLog*.log'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
           ]
-          format: 'text'
-          name: 'CustomTableAdvanced_CL'
-          samplingFrequencyInSeconds: 60
-          settings: {
-            text: {
-              recordStartTimestampFormat: 'ISO 8601'
-            }
-          }
+          outputStream: 'Custom-CustomTableAdvanced_CL'
           streams: [
             'Custom-CustomTableAdvanced_CL'
           ]
+          transformKql: 'source | extend LogFields = split(RawData, \',\') | extend EventTime = todatetime(LogFields[0]) | extend EventLevel = tostring(LogFields[1]) | extend EventCode = toint(LogFields[2]) | extend Message = tostring(LogFields[3]) | project TimeGenerated, EventTime, EventLevel, EventCode, Message'
         }
       ]
-    }
-    destinations: {
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
-        }
-      ]
-    }
-    name: 'idcrcusadv001'
-    // Non-required parameters
-    dataCollectionEndpointId: '<dataCollectionEndpointId>'
-    description: 'Collecting custom text logs with ingestion-time transformation to columns. Expected format of a log line (comma separated values): \'<DateTime>,<EventLevel>,<EventCode>,<Message>\', for example: \'2023-01-25T20:15:05Z,ERROR,404,Page not found\''
-    kind: 'Windows'
-    location: '<location>'
-    streamDeclarations: {
-      'Custom-CustomTableAdvanced_CL': {
-        columns: [
-          {
-            name: 'TimeGenerated'
-            type: 'datetime'
-          }
-          {
-            name: 'EventTime'
-            type: 'datetime'
-          }
-          {
-            name: 'EventLevel'
-            type: 'string'
-          }
-          {
-            name: 'EventCode'
-            type: 'int'
-          }
+      dataSources: {
+        logFiles: [
           {
-            name: 'Message'
-            type: 'string'
+            filePatterns: [
+              'C:\\TestLogsAdvanced\\TestLog*.log'
+            ]
+            format: 'text'
+            name: 'CustomTableAdvanced_CL'
+            samplingFrequencyInSeconds: 60
+            settings: {
+              text: {
+                recordStartTimestampFormat: 'ISO 8601'
+              }
+            }
+            streams: [
+              'Custom-CustomTableAdvanced_CL'
+            ]
           }
+        ]
+      }
+      description: 'Collecting custom text logs with ingestion-time transformation to columns. Expected format of a log line (comma separated values): \'<DateTime>,<EventLevel>,<EventCode>,<Message>\', for example: \'2023-01-25T20:15:05Z,ERROR,404,Page not found\''
+      destinations: {
+        logAnalytics: [
           {
-            name: 'RawData'
-            type: 'string'
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
           }
         ]
       }
+      kind: 'Windows'
+      streamDeclarations: {
+        'Custom-CustomTableAdvanced_CL': {
+          columns: [
+            {
+              name: 'TimeGenerated'
+              type: 'datetime'
+            }
+            {
+              name: 'EventTime'
+              type: 'datetime'
+            }
+            {
+              name: 'EventLevel'
+              type: 'string'
+            }
+            {
+              name: 'EventCode'
+              type: 'int'
+            }
+            {
+              name: 'Message'
+              type: 'string'
+            }
+            {
+              name: 'RawData'
+              type: 'string'
+            }
+          ]
+        }
+      }
     }
+    name: 'idcrcusadv001'
+    // Non-required parameters
+    location: '<location>'
     tags: {
       'hidden-title': 'This is visible in the resource name'
       kind: 'Windows'
@@ -147,100 +224,90 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "outputStream": "Custom-CustomTableAdvanced_CL",
-          "streams": [
-            "Custom-CustomTableAdvanced_CL"
-          ],
-          "transformKql": "source | extend LogFields = split(RawData, \",\") | extend EventTime = todatetime(LogFields[0]) | extend EventLevel = tostring(LogFields[1]) | extend EventCode = toint(LogFields[2]) | extend Message = tostring(LogFields[3]) | project TimeGenerated, EventTime, EventLevel, EventCode, Message"
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "logFiles": [
+        "dataCollectionEndpointResourceId": "<dataCollectionEndpointResourceId>",
+        "dataFlows": [
           {
-            "filePatterns": [
-              "C:\\TestLogsAdvanced\\TestLog*.log"
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
             ],
-            "format": "text",
-            "name": "CustomTableAdvanced_CL",
-            "samplingFrequencyInSeconds": 60,
-            "settings": {
-              "text": {
-                "recordStartTimestampFormat": "ISO 8601"
-              }
-            },
+            "outputStream": "Custom-CustomTableAdvanced_CL",
             "streams": [
               "Custom-CustomTableAdvanced_CL"
-            ]
+            ],
+            "transformKql": "source | extend LogFields = split(RawData, \",\") | extend EventTime = todatetime(LogFields[0]) | extend EventLevel = tostring(LogFields[1]) | extend EventCode = toint(LogFields[2]) | extend Message = tostring(LogFields[3]) | project TimeGenerated, EventTime, EventLevel, EventCode, Message"
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
+        ],
+        "dataSources": {
+          "logFiles": [
+            {
+              "filePatterns": [
+                "C:\\TestLogsAdvanced\\TestLog*.log"
+              ],
+              "format": "text",
+              "name": "CustomTableAdvanced_CL",
+              "samplingFrequencyInSeconds": 60,
+              "settings": {
+                "text": {
+                  "recordStartTimestampFormat": "ISO 8601"
+                }
+              },
+              "streams": [
+                "Custom-CustomTableAdvanced_CL"
+              ]
+            }
+          ]
+        },
+        "description": "Collecting custom text logs with ingestion-time transformation to columns. Expected format of a log line (comma separated values): \"<DateTime>,<EventLevel>,<EventCode>,<Message>\", for example: \"2023-01-25T20:15:05Z,ERROR,404,Page not found\"",
+        "destinations": {
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
+        },
+        "kind": "Windows",
+        "streamDeclarations": {
+          "Custom-CustomTableAdvanced_CL": {
+            "columns": [
+              {
+                "name": "TimeGenerated",
+                "type": "datetime"
+              },
+              {
+                "name": "EventTime",
+                "type": "datetime"
+              },
+              {
+                "name": "EventLevel",
+                "type": "string"
+              },
+              {
+                "name": "EventCode",
+                "type": "int"
+              },
+              {
+                "name": "Message",
+                "type": "string"
+              },
+              {
+                "name": "RawData",
+                "type": "string"
+              }
+            ]
           }
-        ]
+        }
       }
     },
     "name": {
       "value": "idcrcusadv001"
     },
     // Non-required parameters
-    "dataCollectionEndpointId": {
-      "value": "<dataCollectionEndpointId>"
-    },
-    "description": {
-      "value": "Collecting custom text logs with ingestion-time transformation to columns. Expected format of a log line (comma separated values): \"<DateTime>,<EventLevel>,<EventCode>,<Message>\", for example: \"2023-01-25T20:15:05Z,ERROR,404,Page not found\""
-    },
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     },
-    "streamDeclarations": {
-      "value": {
-        "Custom-CustomTableAdvanced_CL": {
-          "columns": [
-            {
-              "name": "TimeGenerated",
-              "type": "datetime"
-            },
-            {
-              "name": "EventTime",
-              "type": "datetime"
-            },
-            {
-              "name": "EventLevel",
-              "type": "string"
-            },
-            {
-              "name": "EventCode",
-              "type": "int"
-            },
-            {
-              "name": "Message",
-              "type": "string"
-            },
-            {
-              "name": "RawData",
-              "type": "string"
-            }
-          ]
-        }
-      }
-    },
     "tags": {
       "value": {
         "hidden-title": "This is visible in the resource name",
@@ -255,7 +322,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 2: _Collecting custom text logs_
+### Example 3: _Collecting custom text logs_
 
 This instance deploys the module to setup collection of custom logs.
 
@@ -269,66 +336,68 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        outputStream: 'Custom-CustomTableBasic_CL'
-        streams: [
-          'Custom-CustomTableBasic_CL'
-        ]
-        transformKql: 'source'
-      }
-    ]
-    dataSources: {
-      logFiles: [
+    dataCollectionRuleProperties: {
+      dataCollectionEndpointResourceId: '<dataCollectionEndpointResourceId>'
+      dataFlows: [
         {
-          filePatterns: [
-            'C:\\TestLogsBasic\\TestLog*.log'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
           ]
-          format: 'text'
-          name: 'CustomTableBasic_CL'
-          samplingFrequencyInSeconds: 60
-          settings: {
-            text: {
-              recordStartTimestampFormat: 'ISO 8601'
-            }
-          }
+          outputStream: 'Custom-CustomTableBasic_CL'
           streams: [
             'Custom-CustomTableBasic_CL'
           ]
+          transformKql: 'source'
         }
       ]
-    }
-    destinations: {
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
-        }
-      ]
-    }
-    name: 'idcrcusbas001'
-    // Non-required parameters
-    dataCollectionEndpointId: '<dataCollectionEndpointId>'
-    description: 'Collecting custom text logs without ingestion-time transformation.'
-    kind: 'Windows'
-    location: '<location>'
-    streamDeclarations: {
-      'Custom-CustomTableBasic_CL': {
-        columns: [
+      dataSources: {
+        logFiles: [
           {
-            name: 'TimeGenerated'
-            type: 'datetime'
+            filePatterns: [
+              'C:\\TestLogsBasic\\TestLog*.log'
+            ]
+            format: 'text'
+            name: 'CustomTableBasic_CL'
+            samplingFrequencyInSeconds: 60
+            settings: {
+              text: {
+                recordStartTimestampFormat: 'ISO 8601'
+              }
+            }
+            streams: [
+              'Custom-CustomTableBasic_CL'
+            ]
           }
+        ]
+      }
+      description: 'Collecting custom text logs without ingestion-time transformation.'
+      destinations: {
+        logAnalytics: [
           {
-            name: 'RawData'
-            type: 'string'
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
           }
         ]
       }
+      kind: 'Windows'
+      streamDeclarations: {
+        'Custom-CustomTableBasic_CL': {
+          columns: [
+            {
+              name: 'TimeGenerated'
+              type: 'datetime'
+            }
+            {
+              name: 'RawData'
+              type: 'string'
+            }
+          ]
+        }
+      }
     }
+    name: 'idcrcusbas001'
+    // Non-required parameters
+    location: '<location>'
     tags: {
       'hidden-title': 'This is visible in the resource name'
       kind: 'Windows'
@@ -351,84 +420,74 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "outputStream": "Custom-CustomTableBasic_CL",
-          "streams": [
-            "Custom-CustomTableBasic_CL"
-          ],
-          "transformKql": "source"
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "logFiles": [
+        "dataCollectionEndpointResourceId": "<dataCollectionEndpointResourceId>",
+        "dataFlows": [
           {
-            "filePatterns": [
-              "C:\\TestLogsBasic\\TestLog*.log"
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
             ],
-            "format": "text",
-            "name": "CustomTableBasic_CL",
-            "samplingFrequencyInSeconds": 60,
-            "settings": {
-              "text": {
-                "recordStartTimestampFormat": "ISO 8601"
-              }
-            },
+            "outputStream": "Custom-CustomTableBasic_CL",
             "streams": [
               "Custom-CustomTableBasic_CL"
-            ]
+            ],
+            "transformKql": "source"
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
+        ],
+        "dataSources": {
+          "logFiles": [
+            {
+              "filePatterns": [
+                "C:\\TestLogsBasic\\TestLog*.log"
+              ],
+              "format": "text",
+              "name": "CustomTableBasic_CL",
+              "samplingFrequencyInSeconds": 60,
+              "settings": {
+                "text": {
+                  "recordStartTimestampFormat": "ISO 8601"
+                }
+              },
+              "streams": [
+                "Custom-CustomTableBasic_CL"
+              ]
+            }
+          ]
+        },
+        "description": "Collecting custom text logs without ingestion-time transformation.",
+        "destinations": {
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
+        },
+        "kind": "Windows",
+        "streamDeclarations": {
+          "Custom-CustomTableBasic_CL": {
+            "columns": [
+              {
+                "name": "TimeGenerated",
+                "type": "datetime"
+              },
+              {
+                "name": "RawData",
+                "type": "string"
+              }
+            ]
           }
-        ]
+        }
       }
     },
     "name": {
       "value": "idcrcusbas001"
     },
     // Non-required parameters
-    "dataCollectionEndpointId": {
-      "value": "<dataCollectionEndpointId>"
-    },
-    "description": {
-      "value": "Collecting custom text logs without ingestion-time transformation."
-    },
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     },
-    "streamDeclarations": {
-      "value": {
-        "Custom-CustomTableBasic_CL": {
-          "columns": [
-            {
-              "name": "TimeGenerated",
-              "type": "datetime"
-            },
-            {
-              "name": "RawData",
-              "type": "string"
-            }
-          ]
-        }
-      }
-    },
     "tags": {
       "value": {
         "hidden-title": "This is visible in the resource name",
@@ -443,7 +502,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 3: _Collecting IIS logs_
+### Example 4: _Collecting IIS logs_
 
 This instance deploys the module to setup the collection of IIS logs.
 
@@ -457,44 +516,46 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        outputStream: 'Microsoft-W3CIISLog'
-        streams: [
-          'Microsoft-W3CIISLog'
-        ]
-        transformKql: 'source'
-      }
-    ]
-    dataSources: {
-      iisLogs: [
+    dataCollectionRuleProperties: {
+      dataCollectionEndpointResourceId: '<dataCollectionEndpointResourceId>'
+      dataFlows: [
         {
-          logDirectories: [
-            'C:\\inetpub\\logs\\LogFiles\\W3SVC1'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
           ]
-          name: 'iisLogsDataSource'
+          outputStream: 'Microsoft-W3CIISLog'
           streams: [
             'Microsoft-W3CIISLog'
           ]
+          transformKql: 'source'
         }
       ]
-    }
-    destinations: {
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
-        }
-      ]
+      dataSources: {
+        iisLogs: [
+          {
+            logDirectories: [
+              'C:\\inetpub\\logs\\LogFiles\\W3SVC1'
+            ]
+            name: 'iisLogsDataSource'
+            streams: [
+              'Microsoft-W3CIISLog'
+            ]
+          }
+        ]
+      }
+      description: 'Collecting IIS logs.'
+      destinations: {
+        logAnalytics: [
+          {
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
+          }
+        ]
+      }
+      kind: 'Windows'
     }
     name: 'idcrcusiis001'
     // Non-required parameters
-    dataCollectionEndpointId: '<dataCollectionEndpointId>'
-    description: 'Collecting IIS logs.'
-    kind: 'Windows'
     location: '<location>'
     tags: {
       'hidden-title': 'This is visible in the resource name'
@@ -518,58 +579,50 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "outputStream": "Microsoft-W3CIISLog",
-          "streams": [
-            "Microsoft-W3CIISLog"
-          ],
-          "transformKql": "source"
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "iisLogs": [
+        "dataCollectionEndpointResourceId": "<dataCollectionEndpointResourceId>",
+        "dataFlows": [
           {
-            "logDirectories": [
-              "C:\\inetpub\\logs\\LogFiles\\W3SVC1"
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
             ],
-            "name": "iisLogsDataSource",
+            "outputStream": "Microsoft-W3CIISLog",
             "streams": [
               "Microsoft-W3CIISLog"
-            ]
-          }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
+            ],
+            "transformKql": "source"
           }
-        ]
+        ],
+        "dataSources": {
+          "iisLogs": [
+            {
+              "logDirectories": [
+                "C:\\inetpub\\logs\\LogFiles\\W3SVC1"
+              ],
+              "name": "iisLogsDataSource",
+              "streams": [
+                "Microsoft-W3CIISLog"
+              ]
+            }
+          ]
+        },
+        "description": "Collecting IIS logs.",
+        "destinations": {
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
+        },
+        "kind": "Windows"
       }
     },
     "name": {
       "value": "idcrcusiis001"
     },
     // Non-required parameters
-    "dataCollectionEndpointId": {
-      "value": "<dataCollectionEndpointId>"
-    },
-    "description": {
-      "value": "Collecting IIS logs."
-    },
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     },
@@ -587,7 +640,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 4: _Using only defaults_
+### Example 5: _Using only defaults_
 
 This instance deploys the module with the minimum set of required parameters.
 
@@ -601,47 +654,49 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          'azureMonitorMetrics-default'
-        ]
-        streams: [
-          'Microsoft-InsightsMetrics'
-        ]
-      }
-    ]
-    dataSources: {
-      performanceCounters: [
+    dataCollectionRuleProperties: {
+      dataFlows: [
         {
-          counterSpecifiers: [
-            '\\Process(_Total)\\Handle Count'
-            '\\Process(_Total)\\Thread Count'
-            '\\Processor Information(_Total)\\% Privileged Time'
-            '\\Processor Information(_Total)\\% Processor Time'
-            '\\Processor Information(_Total)\\% User Time'
-            '\\Processor Information(_Total)\\Processor Frequency'
-            '\\System\\Context Switches/sec'
-            '\\System\\Processes'
-            '\\System\\Processor Queue Length'
-            '\\System\\System Up Time'
+          destinations: [
+            'azureMonitorMetrics-default'
           ]
-          name: 'perfCounterDataSource60'
-          samplingFrequencyInSeconds: 60
           streams: [
             'Microsoft-InsightsMetrics'
           ]
         }
       ]
-    }
-    destinations: {
-      azureMonitorMetrics: {
-        name: 'azureMonitorMetrics-default'
+      dataSources: {
+        performanceCounters: [
+          {
+            counterSpecifiers: [
+              '\\Process(_Total)\\Handle Count'
+              '\\Process(_Total)\\Thread Count'
+              '\\Processor Information(_Total)\\% Privileged Time'
+              '\\Processor Information(_Total)\\% Processor Time'
+              '\\Processor Information(_Total)\\% User Time'
+              '\\Processor Information(_Total)\\Processor Frequency'
+              '\\System\\Context Switches/sec'
+              '\\System\\Processes'
+              '\\System\\Processor Queue Length'
+              '\\System\\System Up Time'
+            ]
+            name: 'perfCounterDataSource60'
+            samplingFrequencyInSeconds: 60
+            streams: [
+              'Microsoft-InsightsMetrics'
+            ]
+          }
+        ]
       }
+      destinations: {
+        azureMonitorMetrics: {
+          name: 'azureMonitorMetrics-default'
+        }
+      }
+      kind: 'Windows'
     }
     name: 'idcrmin001'
     // Non-required parameters
-    kind: 'Windows'
     location: '<location>'
   }
 }
@@ -660,57 +715,53 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "azureMonitorMetrics-default"
-          ],
-          "streams": [
-            "Microsoft-InsightsMetrics"
-          ]
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "performanceCounters": [
+        "dataFlows": [
           {
-            "counterSpecifiers": [
-              "\\Process(_Total)\\Handle Count",
-              "\\Process(_Total)\\Thread Count",
-              "\\Processor Information(_Total)\\% Privileged Time",
-              "\\Processor Information(_Total)\\% Processor Time",
-              "\\Processor Information(_Total)\\% User Time",
-              "\\Processor Information(_Total)\\Processor Frequency",
-              "\\System\\Context Switches/sec",
-              "\\System\\Processes",
-              "\\System\\Processor Queue Length",
-              "\\System\\System Up Time"
+            "destinations": [
+              "azureMonitorMetrics-default"
             ],
-            "name": "perfCounterDataSource60",
-            "samplingFrequencyInSeconds": 60,
             "streams": [
               "Microsoft-InsightsMetrics"
             ]
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "azureMonitorMetrics": {
-          "name": "azureMonitorMetrics-default"
-        }
+        ],
+        "dataSources": {
+          "performanceCounters": [
+            {
+              "counterSpecifiers": [
+                "\\Process(_Total)\\Handle Count",
+                "\\Process(_Total)\\Thread Count",
+                "\\Processor Information(_Total)\\% Privileged Time",
+                "\\Processor Information(_Total)\\% Processor Time",
+                "\\Processor Information(_Total)\\% User Time",
+                "\\Processor Information(_Total)\\Processor Frequency",
+                "\\System\\Context Switches/sec",
+                "\\System\\Processes",
+                "\\System\\Processor Queue Length",
+                "\\System\\System Up Time"
+              ],
+              "name": "perfCounterDataSource60",
+              "samplingFrequencyInSeconds": 60,
+              "streams": [
+                "Microsoft-InsightsMetrics"
+              ]
+            }
+          ]
+        },
+        "destinations": {
+          "azureMonitorMetrics": {
+            "name": "azureMonitorMetrics-default"
+          }
+        },
+        "kind": "Windows"
       }
     },
     "name": {
       "value": "idcrmin001"
     },
     // Non-required parameters
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     }
@@ -721,7 +772,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 5: _Collecting Linux-specific information_
+### Example 6: _Collecting Linux-specific information_
 
 This instance deploys the module to setup the collection of Linux-specific performance counters and Linux Syslog.
 
@@ -735,157 +786,159 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          'azureMonitorMetrics-default'
-        ]
-        streams: [
-          'Microsoft-InsightsMetrics'
-        ]
-      }
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        streams: [
-          'Microsoft-Syslog'
-        ]
-      }
-    ]
-    dataSources: {
-      performanceCounters: [
+    dataCollectionRuleProperties: {
+      dataFlows: [
         {
-          counterSpecifiers: [
-            'Logical Disk(*)\\% Free Inodes'
-            'Logical Disk(*)\\% Free Space'
-            'Logical Disk(*)\\% Used Inodes'
-            'Logical Disk(*)\\% Used Space'
-            'Logical Disk(*)\\Disk Read Bytes/sec'
-            'Logical Disk(*)\\Disk Reads/sec'
-            'Logical Disk(*)\\Disk Transfers/sec'
-            'Logical Disk(*)\\Disk Write Bytes/sec'
-            'Logical Disk(*)\\Disk Writes/sec'
-            'Logical Disk(*)\\Free Megabytes'
-            'Logical Disk(*)\\Logical Disk Bytes/sec'
-            'Memory(*)\\% Available Memory'
-            'Memory(*)\\% Available Swap Space'
-            'Memory(*)\\% Used Memory'
-            'Memory(*)\\% Used Swap Space'
-            'Memory(*)\\Available MBytes Memory'
-            'Memory(*)\\Available MBytes Swap'
-            'Memory(*)\\Page Reads/sec'
-            'Memory(*)\\Page Writes/sec'
-            'Memory(*)\\Pages/sec'
-            'Memory(*)\\Used MBytes Swap Space'
-            'Memory(*)\\Used Memory MBytes'
-            'Network(*)\\Total Bytes'
-            'Network(*)\\Total Bytes Received'
-            'Network(*)\\Total Bytes Transmitted'
-            'Network(*)\\Total Collisions'
-            'Network(*)\\Total Packets Received'
-            'Network(*)\\Total Packets Transmitted'
-            'Network(*)\\Total Rx Errors'
-            'Network(*)\\Total Tx Errors'
-            'Processor(*)\\% DPC Time'
-            'Processor(*)\\% Idle Time'
-            'Processor(*)\\% Interrupt Time'
-            'Processor(*)\\% IO Wait Time'
-            'Processor(*)\\% Nice Time'
-            'Processor(*)\\% Privileged Time'
-            'Processor(*)\\% Processor Time'
-            'Processor(*)\\% User Time'
+          destinations: [
+            'azureMonitorMetrics-default'
           ]
-          name: 'perfCounterDataSource60'
-          samplingFrequencyInSeconds: 60
           streams: [
             'Microsoft-InsightsMetrics'
           ]
         }
-      ]
-      syslog: [
         {
-          facilityNames: [
-            'auth'
-            'authpriv'
-          ]
-          logLevels: [
-            'Alert'
-            'Critical'
-            'Debug'
-            'Emergency'
-            'Error'
-            'Info'
-            'Notice'
-            'Warning'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
           ]
-          name: 'sysLogsDataSource-debugLevel'
-          streams: [
-            'Microsoft-Syslog'
-          ]
-        }
-        {
-          facilityNames: [
-            'cron'
-            'daemon'
-            'kern'
-            'local0'
-            'mark'
-          ]
-          logLevels: [
-            'Alert'
-            'Critical'
-            'Emergency'
-            'Error'
-            'Warning'
-          ]
-          name: 'sysLogsDataSource-warningLevel'
-          streams: [
-            'Microsoft-Syslog'
-          ]
-        }
-        {
-          facilityNames: [
-            'local1'
-            'local2'
-            'local3'
-            'local4'
-            'local5'
-            'local6'
-            'local7'
-            'lpr'
-            'mail'
-            'news'
-            'syslog'
-          ]
-          logLevels: [
-            'Alert'
-            'Critical'
-            'Emergency'
-            'Error'
-          ]
-          name: 'sysLogsDataSource-errLevel'
           streams: [
             'Microsoft-Syslog'
           ]
         }
       ]
-    }
-    destinations: {
-      azureMonitorMetrics: {
-        name: 'azureMonitorMetrics-default'
+      dataSources: {
+        performanceCounters: [
+          {
+            counterSpecifiers: [
+              'Logical Disk(*)\\% Free Inodes'
+              'Logical Disk(*)\\% Free Space'
+              'Logical Disk(*)\\% Used Inodes'
+              'Logical Disk(*)\\% Used Space'
+              'Logical Disk(*)\\Disk Read Bytes/sec'
+              'Logical Disk(*)\\Disk Reads/sec'
+              'Logical Disk(*)\\Disk Transfers/sec'
+              'Logical Disk(*)\\Disk Write Bytes/sec'
+              'Logical Disk(*)\\Disk Writes/sec'
+              'Logical Disk(*)\\Free Megabytes'
+              'Logical Disk(*)\\Logical Disk Bytes/sec'
+              'Memory(*)\\% Available Memory'
+              'Memory(*)\\% Available Swap Space'
+              'Memory(*)\\% Used Memory'
+              'Memory(*)\\% Used Swap Space'
+              'Memory(*)\\Available MBytes Memory'
+              'Memory(*)\\Available MBytes Swap'
+              'Memory(*)\\Page Reads/sec'
+              'Memory(*)\\Page Writes/sec'
+              'Memory(*)\\Pages/sec'
+              'Memory(*)\\Used MBytes Swap Space'
+              'Memory(*)\\Used Memory MBytes'
+              'Network(*)\\Total Bytes'
+              'Network(*)\\Total Bytes Received'
+              'Network(*)\\Total Bytes Transmitted'
+              'Network(*)\\Total Collisions'
+              'Network(*)\\Total Packets Received'
+              'Network(*)\\Total Packets Transmitted'
+              'Network(*)\\Total Rx Errors'
+              'Network(*)\\Total Tx Errors'
+              'Processor(*)\\% DPC Time'
+              'Processor(*)\\% Idle Time'
+              'Processor(*)\\% Interrupt Time'
+              'Processor(*)\\% IO Wait Time'
+              'Processor(*)\\% Nice Time'
+              'Processor(*)\\% Privileged Time'
+              'Processor(*)\\% Processor Time'
+              'Processor(*)\\% User Time'
+            ]
+            name: 'perfCounterDataSource60'
+            samplingFrequencyInSeconds: 60
+            streams: [
+              'Microsoft-InsightsMetrics'
+            ]
+          }
+        ]
+        syslog: [
+          {
+            facilityNames: [
+              'auth'
+              'authpriv'
+            ]
+            logLevels: [
+              'Alert'
+              'Critical'
+              'Debug'
+              'Emergency'
+              'Error'
+              'Info'
+              'Notice'
+              'Warning'
+            ]
+            name: 'sysLogsDataSource-debugLevel'
+            streams: [
+              'Microsoft-Syslog'
+            ]
+          }
+          {
+            facilityNames: [
+              'cron'
+              'daemon'
+              'kern'
+              'local0'
+              'mark'
+            ]
+            logLevels: [
+              'Alert'
+              'Critical'
+              'Emergency'
+              'Error'
+              'Warning'
+            ]
+            name: 'sysLogsDataSource-warningLevel'
+            streams: [
+              'Microsoft-Syslog'
+            ]
+          }
+          {
+            facilityNames: [
+              'local1'
+              'local2'
+              'local3'
+              'local4'
+              'local5'
+              'local6'
+              'local7'
+              'lpr'
+              'mail'
+              'news'
+              'syslog'
+            ]
+            logLevels: [
+              'Alert'
+              'Critical'
+              'Emergency'
+              'Error'
+            ]
+            name: 'sysLogsDataSource-errLevel'
+            streams: [
+              'Microsoft-Syslog'
+            ]
+          }
+        ]
       }
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
+      description: 'Collecting Linux-specific performance counters and Linux Syslog'
+      destinations: {
+        azureMonitorMetrics: {
+          name: 'azureMonitorMetrics-default'
         }
-      ]
+        logAnalytics: [
+          {
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
+          }
+        ]
+      }
+      kind: 'Linux'
     }
     name: 'idcrlin001'
     // Non-required parameters
-    description: 'Collecting Linux-specific performance counters and Linux Syslog'
-    kind: 'Linux'
     location: '<location>'
     tags: {
       'hidden-title': 'This is visible in the resource name'
@@ -909,169 +962,163 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "azureMonitorMetrics-default"
-          ],
-          "streams": [
-            "Microsoft-InsightsMetrics"
-          ]
-        },
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "streams": [
-            "Microsoft-Syslog"
-          ]
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "performanceCounters": [
+        "dataFlows": [
           {
-            "counterSpecifiers": [
-              "Logical Disk(*)\\% Free Inodes",
-              "Logical Disk(*)\\% Free Space",
-              "Logical Disk(*)\\% Used Inodes",
-              "Logical Disk(*)\\% Used Space",
-              "Logical Disk(*)\\Disk Read Bytes/sec",
-              "Logical Disk(*)\\Disk Reads/sec",
-              "Logical Disk(*)\\Disk Transfers/sec",
-              "Logical Disk(*)\\Disk Write Bytes/sec",
-              "Logical Disk(*)\\Disk Writes/sec",
-              "Logical Disk(*)\\Free Megabytes",
-              "Logical Disk(*)\\Logical Disk Bytes/sec",
-              "Memory(*)\\% Available Memory",
-              "Memory(*)\\% Available Swap Space",
-              "Memory(*)\\% Used Memory",
-              "Memory(*)\\% Used Swap Space",
-              "Memory(*)\\Available MBytes Memory",
-              "Memory(*)\\Available MBytes Swap",
-              "Memory(*)\\Page Reads/sec",
-              "Memory(*)\\Page Writes/sec",
-              "Memory(*)\\Pages/sec",
-              "Memory(*)\\Used MBytes Swap Space",
-              "Memory(*)\\Used Memory MBytes",
-              "Network(*)\\Total Bytes",
-              "Network(*)\\Total Bytes Received",
-              "Network(*)\\Total Bytes Transmitted",
-              "Network(*)\\Total Collisions",
-              "Network(*)\\Total Packets Received",
-              "Network(*)\\Total Packets Transmitted",
-              "Network(*)\\Total Rx Errors",
-              "Network(*)\\Total Tx Errors",
-              "Processor(*)\\% DPC Time",
-              "Processor(*)\\% Idle Time",
-              "Processor(*)\\% Interrupt Time",
-              "Processor(*)\\% IO Wait Time",
-              "Processor(*)\\% Nice Time",
-              "Processor(*)\\% Privileged Time",
-              "Processor(*)\\% Processor Time",
-              "Processor(*)\\% User Time"
+            "destinations": [
+              "azureMonitorMetrics-default"
             ],
-            "name": "perfCounterDataSource60",
-            "samplingFrequencyInSeconds": 60,
             "streams": [
               "Microsoft-InsightsMetrics"
             ]
-          }
-        ],
-        "syslog": [
-          {
-            "facilityNames": [
-              "auth",
-              "authpriv"
-            ],
-            "logLevels": [
-              "Alert",
-              "Critical",
-              "Debug",
-              "Emergency",
-              "Error",
-              "Info",
-              "Notice",
-              "Warning"
-            ],
-            "name": "sysLogsDataSource-debugLevel",
-            "streams": [
-              "Microsoft-Syslog"
-            ]
           },
           {
-            "facilityNames": [
-              "cron",
-              "daemon",
-              "kern",
-              "local0",
-              "mark"
-            ],
-            "logLevels": [
-              "Alert",
-              "Critical",
-              "Emergency",
-              "Error",
-              "Warning"
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
             ],
-            "name": "sysLogsDataSource-warningLevel",
-            "streams": [
-              "Microsoft-Syslog"
-            ]
-          },
-          {
-            "facilityNames": [
-              "local1",
-              "local2",
-              "local3",
-              "local4",
-              "local5",
-              "local6",
-              "local7",
-              "lpr",
-              "mail",
-              "news",
-              "syslog"
-            ],
-            "logLevels": [
-              "Alert",
-              "Critical",
-              "Emergency",
-              "Error"
-            ],
-            "name": "sysLogsDataSource-errLevel",
             "streams": [
               "Microsoft-Syslog"
             ]
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "azureMonitorMetrics": {
-          "name": "azureMonitorMetrics-default"
+        ],
+        "dataSources": {
+          "performanceCounters": [
+            {
+              "counterSpecifiers": [
+                "Logical Disk(*)\\% Free Inodes",
+                "Logical Disk(*)\\% Free Space",
+                "Logical Disk(*)\\% Used Inodes",
+                "Logical Disk(*)\\% Used Space",
+                "Logical Disk(*)\\Disk Read Bytes/sec",
+                "Logical Disk(*)\\Disk Reads/sec",
+                "Logical Disk(*)\\Disk Transfers/sec",
+                "Logical Disk(*)\\Disk Write Bytes/sec",
+                "Logical Disk(*)\\Disk Writes/sec",
+                "Logical Disk(*)\\Free Megabytes",
+                "Logical Disk(*)\\Logical Disk Bytes/sec",
+                "Memory(*)\\% Available Memory",
+                "Memory(*)\\% Available Swap Space",
+                "Memory(*)\\% Used Memory",
+                "Memory(*)\\% Used Swap Space",
+                "Memory(*)\\Available MBytes Memory",
+                "Memory(*)\\Available MBytes Swap",
+                "Memory(*)\\Page Reads/sec",
+                "Memory(*)\\Page Writes/sec",
+                "Memory(*)\\Pages/sec",
+                "Memory(*)\\Used MBytes Swap Space",
+                "Memory(*)\\Used Memory MBytes",
+                "Network(*)\\Total Bytes",
+                "Network(*)\\Total Bytes Received",
+                "Network(*)\\Total Bytes Transmitted",
+                "Network(*)\\Total Collisions",
+                "Network(*)\\Total Packets Received",
+                "Network(*)\\Total Packets Transmitted",
+                "Network(*)\\Total Rx Errors",
+                "Network(*)\\Total Tx Errors",
+                "Processor(*)\\% DPC Time",
+                "Processor(*)\\% Idle Time",
+                "Processor(*)\\% Interrupt Time",
+                "Processor(*)\\% IO Wait Time",
+                "Processor(*)\\% Nice Time",
+                "Processor(*)\\% Privileged Time",
+                "Processor(*)\\% Processor Time",
+                "Processor(*)\\% User Time"
+              ],
+              "name": "perfCounterDataSource60",
+              "samplingFrequencyInSeconds": 60,
+              "streams": [
+                "Microsoft-InsightsMetrics"
+              ]
+            }
+          ],
+          "syslog": [
+            {
+              "facilityNames": [
+                "auth",
+                "authpriv"
+              ],
+              "logLevels": [
+                "Alert",
+                "Critical",
+                "Debug",
+                "Emergency",
+                "Error",
+                "Info",
+                "Notice",
+                "Warning"
+              ],
+              "name": "sysLogsDataSource-debugLevel",
+              "streams": [
+                "Microsoft-Syslog"
+              ]
+            },
+            {
+              "facilityNames": [
+                "cron",
+                "daemon",
+                "kern",
+                "local0",
+                "mark"
+              ],
+              "logLevels": [
+                "Alert",
+                "Critical",
+                "Emergency",
+                "Error",
+                "Warning"
+              ],
+              "name": "sysLogsDataSource-warningLevel",
+              "streams": [
+                "Microsoft-Syslog"
+              ]
+            },
+            {
+              "facilityNames": [
+                "local1",
+                "local2",
+                "local3",
+                "local4",
+                "local5",
+                "local6",
+                "local7",
+                "lpr",
+                "mail",
+                "news",
+                "syslog"
+              ],
+              "logLevels": [
+                "Alert",
+                "Critical",
+                "Emergency",
+                "Error"
+              ],
+              "name": "sysLogsDataSource-errLevel",
+              "streams": [
+                "Microsoft-Syslog"
+              ]
+            }
+          ]
+        },
+        "description": "Collecting Linux-specific performance counters and Linux Syslog",
+        "destinations": {
+          "azureMonitorMetrics": {
+            "name": "azureMonitorMetrics-default"
+          },
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
         },
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
-          }
-        ]
+        "kind": "Linux"
       }
     },
     "name": {
       "value": "idcrlin001"
     },
     // Non-required parameters
-    "description": {
-      "value": "Collecting Linux-specific performance counters and Linux Syslog"
-    },
-    "kind": {
-      "value": "Linux"
-    },
     "location": {
       "value": "<location>"
     },
@@ -1089,7 +1136,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 6: _Using large parameter set_
+### Example 7: _Using large parameter set_
 
 This instance deploys the module with most of its features enabled.
 
@@ -1103,51 +1150,67 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        outputStream: 'Custom-CustomTableBasic_CL'
-        streams: [
-          'Custom-CustomTableBasic_CL'
-        ]
-        transformKql: 'source'
-      }
-    ]
-    dataSources: {
-      logFiles: [
+    dataCollectionRuleProperties: {
+      dataCollectionEndpointResourceId: '<dataCollectionEndpointResourceId>'
+      dataFlows: [
         {
-          filePatterns: [
-            'C:\\TestLogsBasic\\TestLog*.log'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
           ]
-          format: 'text'
-          name: 'CustomTableBasic_CL'
-          samplingFrequencyInSeconds: 60
-          settings: {
-            text: {
-              recordStartTimestampFormat: 'ISO 8601'
-            }
-          }
+          outputStream: 'Custom-CustomTableBasic_CL'
           streams: [
             'Custom-CustomTableBasic_CL'
           ]
+          transformKql: 'source'
         }
       ]
-    }
-    destinations: {
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
+      dataSources: {
+        logFiles: [
+          {
+            filePatterns: [
+              'C:\\TestLogsBasic\\TestLog*.log'
+            ]
+            format: 'text'
+            name: 'CustomTableBasic_CL'
+            samplingFrequencyInSeconds: 60
+            settings: {
+              text: {
+                recordStartTimestampFormat: 'ISO 8601'
+              }
+            }
+            streams: [
+              'Custom-CustomTableBasic_CL'
+            ]
+          }
+        ]
+      }
+      description: 'Collecting custom text logs without ingestion-time transformation.'
+      destinations: {
+        logAnalytics: [
+          {
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
+          }
+        ]
+      }
+      kind: 'Windows'
+      streamDeclarations: {
+        'Custom-CustomTableBasic_CL': {
+          columns: [
+            {
+              name: 'TimeGenerated'
+              type: 'datetime'
+            }
+            {
+              name: 'RawData'
+              type: 'string'
+            }
+          ]
         }
-      ]
+      }
     }
     name: 'idcrmax001'
     // Non-required parameters
-    dataCollectionEndpointId: '<dataCollectionEndpointId>'
-    description: 'Collecting custom text logs without ingestion-time transformation.'
-    kind: 'Windows'
     location: '<location>'
     lock: {
       kind: 'CanNotDelete'
@@ -1172,20 +1235,6 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
         roleDefinitionIdOrName: '<roleDefinitionIdOrName>'
       }
     ]
-    streamDeclarations: {
-      'Custom-CustomTableBasic_CL': {
-        columns: [
-          {
-            name: 'TimeGenerated'
-            type: 'datetime'
-          }
-          {
-            name: 'RawData'
-            type: 'string'
-          }
-        ]
-      }
-    }
     tags: {
       'hidden-title': 'This is visible in the resource name'
       kind: 'Windows'
@@ -1208,65 +1257,71 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "outputStream": "Custom-CustomTableBasic_CL",
-          "streams": [
-            "Custom-CustomTableBasic_CL"
-          ],
-          "transformKql": "source"
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "logFiles": [
+        "dataCollectionEndpointResourceId": "<dataCollectionEndpointResourceId>",
+        "dataFlows": [
           {
-            "filePatterns": [
-              "C:\\TestLogsBasic\\TestLog*.log"
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
             ],
-            "format": "text",
-            "name": "CustomTableBasic_CL",
-            "samplingFrequencyInSeconds": 60,
-            "settings": {
-              "text": {
-                "recordStartTimestampFormat": "ISO 8601"
-              }
-            },
+            "outputStream": "Custom-CustomTableBasic_CL",
             "streams": [
               "Custom-CustomTableBasic_CL"
-            ]
+            ],
+            "transformKql": "source"
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
+        ],
+        "dataSources": {
+          "logFiles": [
+            {
+              "filePatterns": [
+                "C:\\TestLogsBasic\\TestLog*.log"
+              ],
+              "format": "text",
+              "name": "CustomTableBasic_CL",
+              "samplingFrequencyInSeconds": 60,
+              "settings": {
+                "text": {
+                  "recordStartTimestampFormat": "ISO 8601"
+                }
+              },
+              "streams": [
+                "Custom-CustomTableBasic_CL"
+              ]
+            }
+          ]
+        },
+        "description": "Collecting custom text logs without ingestion-time transformation.",
+        "destinations": {
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
+        },
+        "kind": "Windows",
+        "streamDeclarations": {
+          "Custom-CustomTableBasic_CL": {
+            "columns": [
+              {
+                "name": "TimeGenerated",
+                "type": "datetime"
+              },
+              {
+                "name": "RawData",
+                "type": "string"
+              }
+            ]
           }
-        ]
+        }
       }
     },
     "name": {
       "value": "idcrmax001"
     },
     // Non-required parameters
-    "dataCollectionEndpointId": {
-      "value": "<dataCollectionEndpointId>"
-    },
-    "description": {
-      "value": "Collecting custom text logs without ingestion-time transformation."
-    },
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     },
@@ -1297,22 +1352,6 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
         }
       ]
     },
-    "streamDeclarations": {
-      "value": {
-        "Custom-CustomTableBasic_CL": {
-          "columns": [
-            {
-              "name": "TimeGenerated",
-              "type": "datetime"
-            },
-            {
-              "name": "RawData",
-              "type": "string"
-            }
-          ]
-        }
-      }
-    },
     "tags": {
       "value": {
         "hidden-title": "This is visible in the resource name",
@@ -1327,7 +1366,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 7: _WAF-aligned_
+### Example 8: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
@@ -1341,111 +1380,113 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          'azureMonitorMetrics-default'
-        ]
-        streams: [
-          'Microsoft-InsightsMetrics'
-        ]
-      }
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        streams: [
-          'Microsoft-Event'
-        ]
-      }
-    ]
-    dataSources: {
-      performanceCounters: [
+    dataCollectionRuleProperties: {
+      dataFlows: [
         {
-          counterSpecifiers: [
-            '\\LogicalDisk(_Total)\\% Disk Read Time'
-            '\\LogicalDisk(_Total)\\% Disk Time'
-            '\\LogicalDisk(_Total)\\% Disk Write Time'
-            '\\LogicalDisk(_Total)\\% Free Space'
-            '\\LogicalDisk(_Total)\\% Idle Time'
-            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
-            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
-            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
-            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
-            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
-            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
-            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
-            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
-            '\\LogicalDisk(_Total)\\Disk Reads/sec'
-            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
-            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
-            '\\LogicalDisk(_Total)\\Disk Writes/sec'
-            '\\LogicalDisk(_Total)\\Free Megabytes'
-            '\\Memory\\% Committed Bytes In Use'
-            '\\Memory\\Available Bytes'
-            '\\Memory\\Cache Bytes'
-            '\\Memory\\Committed Bytes'
-            '\\Memory\\Page Faults/sec'
-            '\\Memory\\Pages/sec'
-            '\\Memory\\Pool Nonpaged Bytes'
-            '\\Memory\\Pool Paged Bytes'
-            '\\Network Interface(*)\\Bytes Received/sec'
-            '\\Network Interface(*)\\Bytes Sent/sec'
-            '\\Network Interface(*)\\Bytes Total/sec'
-            '\\Network Interface(*)\\Packets Outbound Errors'
-            '\\Network Interface(*)\\Packets Received Errors'
-            '\\Network Interface(*)\\Packets Received/sec'
-            '\\Network Interface(*)\\Packets Sent/sec'
-            '\\Network Interface(*)\\Packets/sec'
-            '\\Process(_Total)\\Handle Count'
-            '\\Process(_Total)\\Thread Count'
-            '\\Process(_Total)\\Working Set'
-            '\\Process(_Total)\\Working Set - Private'
-            '\\Processor Information(_Total)\\% Privileged Time'
-            '\\Processor Information(_Total)\\% Processor Time'
-            '\\Processor Information(_Total)\\% User Time'
-            '\\Processor Information(_Total)\\Processor Frequency'
-            '\\System\\Context Switches/sec'
-            '\\System\\Processes'
-            '\\System\\Processor Queue Length'
-            '\\System\\System Up Time'
+          destinations: [
+            'azureMonitorMetrics-default'
           ]
-          name: 'perfCounterDataSource60'
-          samplingFrequencyInSeconds: 60
           streams: [
             'Microsoft-InsightsMetrics'
           ]
         }
-      ]
-      windowsEventLogs: [
         {
-          name: 'eventLogsDataSource'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
+          ]
           streams: [
             'Microsoft-Event'
           ]
-          xPathQueries: [
-            'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
-            'Security!*[System[(band(Keywords,13510798882111488))]]'
-            'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
-          ]
         }
       ]
-    }
-    destinations: {
-      azureMonitorMetrics: {
-        name: 'azureMonitorMetrics-default'
+      dataSources: {
+        performanceCounters: [
+          {
+            counterSpecifiers: [
+              '\\LogicalDisk(_Total)\\% Disk Read Time'
+              '\\LogicalDisk(_Total)\\% Disk Time'
+              '\\LogicalDisk(_Total)\\% Disk Write Time'
+              '\\LogicalDisk(_Total)\\% Free Space'
+              '\\LogicalDisk(_Total)\\% Idle Time'
+              '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+              '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+              '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+              '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Reads/sec'
+              '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+              '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Writes/sec'
+              '\\LogicalDisk(_Total)\\Free Megabytes'
+              '\\Memory\\% Committed Bytes In Use'
+              '\\Memory\\Available Bytes'
+              '\\Memory\\Cache Bytes'
+              '\\Memory\\Committed Bytes'
+              '\\Memory\\Page Faults/sec'
+              '\\Memory\\Pages/sec'
+              '\\Memory\\Pool Nonpaged Bytes'
+              '\\Memory\\Pool Paged Bytes'
+              '\\Network Interface(*)\\Bytes Received/sec'
+              '\\Network Interface(*)\\Bytes Sent/sec'
+              '\\Network Interface(*)\\Bytes Total/sec'
+              '\\Network Interface(*)\\Packets Outbound Errors'
+              '\\Network Interface(*)\\Packets Received Errors'
+              '\\Network Interface(*)\\Packets Received/sec'
+              '\\Network Interface(*)\\Packets Sent/sec'
+              '\\Network Interface(*)\\Packets/sec'
+              '\\Process(_Total)\\Handle Count'
+              '\\Process(_Total)\\Thread Count'
+              '\\Process(_Total)\\Working Set'
+              '\\Process(_Total)\\Working Set - Private'
+              '\\Processor Information(_Total)\\% Privileged Time'
+              '\\Processor Information(_Total)\\% Processor Time'
+              '\\Processor Information(_Total)\\% User Time'
+              '\\Processor Information(_Total)\\Processor Frequency'
+              '\\System\\Context Switches/sec'
+              '\\System\\Processes'
+              '\\System\\Processor Queue Length'
+              '\\System\\System Up Time'
+            ]
+            name: 'perfCounterDataSource60'
+            samplingFrequencyInSeconds: 60
+            streams: [
+              'Microsoft-InsightsMetrics'
+            ]
+          }
+        ]
+        windowsEventLogs: [
+          {
+            name: 'eventLogsDataSource'
+            streams: [
+              'Microsoft-Event'
+            ]
+            xPathQueries: [
+              'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+              'Security!*[System[(band(Keywords,13510798882111488))]]'
+              'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+            ]
+          }
+        ]
       }
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
+      description: 'Collecting Windows-specific performance counters and Windows Event Logs'
+      destinations: {
+        azureMonitorMetrics: {
+          name: 'azureMonitorMetrics-default'
         }
-      ]
+        logAnalytics: [
+          {
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
+          }
+        ]
+      }
+      kind: 'Windows'
     }
     name: 'idcrwaf001'
     // Non-required parameters
-    description: 'Collecting Windows-specific performance counters and Windows Event Logs'
-    kind: 'Windows'
     location: '<location>'
     tags: {
       'hidden-title': 'This is visible in the resource name'
@@ -1469,123 +1510,117 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "azureMonitorMetrics-default"
-          ],
-          "streams": [
-            "Microsoft-InsightsMetrics"
-          ]
-        },
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "streams": [
-            "Microsoft-Event"
-          ]
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "performanceCounters": [
+        "dataFlows": [
           {
-            "counterSpecifiers": [
-              "\\LogicalDisk(_Total)\\% Disk Read Time",
-              "\\LogicalDisk(_Total)\\% Disk Time",
-              "\\LogicalDisk(_Total)\\% Disk Write Time",
-              "\\LogicalDisk(_Total)\\% Free Space",
-              "\\LogicalDisk(_Total)\\% Idle Time",
-              "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
-              "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
-              "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
-              "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
-              "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
-              "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
-              "\\LogicalDisk(_Total)\\Disk Bytes/sec",
-              "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
-              "\\LogicalDisk(_Total)\\Disk Reads/sec",
-              "\\LogicalDisk(_Total)\\Disk Transfers/sec",
-              "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
-              "\\LogicalDisk(_Total)\\Disk Writes/sec",
-              "\\LogicalDisk(_Total)\\Free Megabytes",
-              "\\Memory\\% Committed Bytes In Use",
-              "\\Memory\\Available Bytes",
-              "\\Memory\\Cache Bytes",
-              "\\Memory\\Committed Bytes",
-              "\\Memory\\Page Faults/sec",
-              "\\Memory\\Pages/sec",
-              "\\Memory\\Pool Nonpaged Bytes",
-              "\\Memory\\Pool Paged Bytes",
-              "\\Network Interface(*)\\Bytes Received/sec",
-              "\\Network Interface(*)\\Bytes Sent/sec",
-              "\\Network Interface(*)\\Bytes Total/sec",
-              "\\Network Interface(*)\\Packets Outbound Errors",
-              "\\Network Interface(*)\\Packets Received Errors",
-              "\\Network Interface(*)\\Packets Received/sec",
-              "\\Network Interface(*)\\Packets Sent/sec",
-              "\\Network Interface(*)\\Packets/sec",
-              "\\Process(_Total)\\Handle Count",
-              "\\Process(_Total)\\Thread Count",
-              "\\Process(_Total)\\Working Set",
-              "\\Process(_Total)\\Working Set - Private",
-              "\\Processor Information(_Total)\\% Privileged Time",
-              "\\Processor Information(_Total)\\% Processor Time",
-              "\\Processor Information(_Total)\\% User Time",
-              "\\Processor Information(_Total)\\Processor Frequency",
-              "\\System\\Context Switches/sec",
-              "\\System\\Processes",
-              "\\System\\Processor Queue Length",
-              "\\System\\System Up Time"
+            "destinations": [
+              "azureMonitorMetrics-default"
             ],
-            "name": "perfCounterDataSource60",
-            "samplingFrequencyInSeconds": 60,
             "streams": [
               "Microsoft-InsightsMetrics"
             ]
-          }
-        ],
-        "windowsEventLogs": [
+          },
           {
-            "name": "eventLogsDataSource",
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
+            ],
             "streams": [
               "Microsoft-Event"
-            ],
-            "xPathQueries": [
-              "Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]",
-              "Security!*[System[(band(Keywords,13510798882111488))]]",
-              "System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]"
             ]
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "azureMonitorMetrics": {
-          "name": "azureMonitorMetrics-default"
+        ],
+        "dataSources": {
+          "performanceCounters": [
+            {
+              "counterSpecifiers": [
+                "\\LogicalDisk(_Total)\\% Disk Read Time",
+                "\\LogicalDisk(_Total)\\% Disk Time",
+                "\\LogicalDisk(_Total)\\% Disk Write Time",
+                "\\LogicalDisk(_Total)\\% Free Space",
+                "\\LogicalDisk(_Total)\\% Idle Time",
+                "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
+                "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
+                "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
+                "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
+                "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
+                "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
+                "\\LogicalDisk(_Total)\\Disk Bytes/sec",
+                "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
+                "\\LogicalDisk(_Total)\\Disk Reads/sec",
+                "\\LogicalDisk(_Total)\\Disk Transfers/sec",
+                "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
+                "\\LogicalDisk(_Total)\\Disk Writes/sec",
+                "\\LogicalDisk(_Total)\\Free Megabytes",
+                "\\Memory\\% Committed Bytes In Use",
+                "\\Memory\\Available Bytes",
+                "\\Memory\\Cache Bytes",
+                "\\Memory\\Committed Bytes",
+                "\\Memory\\Page Faults/sec",
+                "\\Memory\\Pages/sec",
+                "\\Memory\\Pool Nonpaged Bytes",
+                "\\Memory\\Pool Paged Bytes",
+                "\\Network Interface(*)\\Bytes Received/sec",
+                "\\Network Interface(*)\\Bytes Sent/sec",
+                "\\Network Interface(*)\\Bytes Total/sec",
+                "\\Network Interface(*)\\Packets Outbound Errors",
+                "\\Network Interface(*)\\Packets Received Errors",
+                "\\Network Interface(*)\\Packets Received/sec",
+                "\\Network Interface(*)\\Packets Sent/sec",
+                "\\Network Interface(*)\\Packets/sec",
+                "\\Process(_Total)\\Handle Count",
+                "\\Process(_Total)\\Thread Count",
+                "\\Process(_Total)\\Working Set",
+                "\\Process(_Total)\\Working Set - Private",
+                "\\Processor Information(_Total)\\% Privileged Time",
+                "\\Processor Information(_Total)\\% Processor Time",
+                "\\Processor Information(_Total)\\% User Time",
+                "\\Processor Information(_Total)\\Processor Frequency",
+                "\\System\\Context Switches/sec",
+                "\\System\\Processes",
+                "\\System\\Processor Queue Length",
+                "\\System\\System Up Time"
+              ],
+              "name": "perfCounterDataSource60",
+              "samplingFrequencyInSeconds": 60,
+              "streams": [
+                "Microsoft-InsightsMetrics"
+              ]
+            }
+          ],
+          "windowsEventLogs": [
+            {
+              "name": "eventLogsDataSource",
+              "streams": [
+                "Microsoft-Event"
+              ],
+              "xPathQueries": [
+                "Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]",
+                "Security!*[System[(band(Keywords,13510798882111488))]]",
+                "System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]"
+              ]
+            }
+          ]
         },
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
-          }
-        ]
+        "description": "Collecting Windows-specific performance counters and Windows Event Logs",
+        "destinations": {
+          "azureMonitorMetrics": {
+            "name": "azureMonitorMetrics-default"
+          },
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
+        },
+        "kind": "Windows"
       }
     },
     "name": {
       "value": "idcrwaf001"
     },
     // Non-required parameters
-    "description": {
-      "value": "Collecting Windows-specific performance counters and Windows Event Logs"
-    },
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     },
@@ -1603,7 +1638,7 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 </details>
 <p>
 
-### Example 8: _Collecting Windows-specific information_
+### Example 9: _Collecting Windows-specific information_
 
 This instance deploys the module to setup the connection of Windows-specific performance counters and Windows Event Logs.
 
@@ -1617,111 +1652,113 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   name: 'dataCollectionRuleDeployment'
   params: {
     // Required parameters
-    dataFlows: [
-      {
-        destinations: [
-          'azureMonitorMetrics-default'
-        ]
-        streams: [
-          'Microsoft-InsightsMetrics'
-        ]
-      }
-      {
-        destinations: [
-          '<logAnalyticsWorkspaceName>'
-        ]
-        streams: [
-          'Microsoft-Event'
-        ]
-      }
-    ]
-    dataSources: {
-      performanceCounters: [
+    dataCollectionRuleProperties: {
+      dataFlows: [
         {
-          counterSpecifiers: [
-            '\\LogicalDisk(_Total)\\% Disk Read Time'
-            '\\LogicalDisk(_Total)\\% Disk Time'
-            '\\LogicalDisk(_Total)\\% Disk Write Time'
-            '\\LogicalDisk(_Total)\\% Free Space'
-            '\\LogicalDisk(_Total)\\% Idle Time'
-            '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
-            '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
-            '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
-            '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
-            '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
-            '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
-            '\\LogicalDisk(_Total)\\Disk Bytes/sec'
-            '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
-            '\\LogicalDisk(_Total)\\Disk Reads/sec'
-            '\\LogicalDisk(_Total)\\Disk Transfers/sec'
-            '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
-            '\\LogicalDisk(_Total)\\Disk Writes/sec'
-            '\\LogicalDisk(_Total)\\Free Megabytes'
-            '\\Memory\\% Committed Bytes In Use'
-            '\\Memory\\Available Bytes'
-            '\\Memory\\Cache Bytes'
-            '\\Memory\\Committed Bytes'
-            '\\Memory\\Page Faults/sec'
-            '\\Memory\\Pages/sec'
-            '\\Memory\\Pool Nonpaged Bytes'
-            '\\Memory\\Pool Paged Bytes'
-            '\\Network Interface(*)\\Bytes Received/sec'
-            '\\Network Interface(*)\\Bytes Sent/sec'
-            '\\Network Interface(*)\\Bytes Total/sec'
-            '\\Network Interface(*)\\Packets Outbound Errors'
-            '\\Network Interface(*)\\Packets Received Errors'
-            '\\Network Interface(*)\\Packets Received/sec'
-            '\\Network Interface(*)\\Packets Sent/sec'
-            '\\Network Interface(*)\\Packets/sec'
-            '\\Process(_Total)\\Handle Count'
-            '\\Process(_Total)\\Thread Count'
-            '\\Process(_Total)\\Working Set'
-            '\\Process(_Total)\\Working Set - Private'
-            '\\Processor Information(_Total)\\% Privileged Time'
-            '\\Processor Information(_Total)\\% Processor Time'
-            '\\Processor Information(_Total)\\% User Time'
-            '\\Processor Information(_Total)\\Processor Frequency'
-            '\\System\\Context Switches/sec'
-            '\\System\\Processes'
-            '\\System\\Processor Queue Length'
-            '\\System\\System Up Time'
+          destinations: [
+            'azureMonitorMetrics-default'
           ]
-          name: 'perfCounterDataSource60'
-          samplingFrequencyInSeconds: 60
           streams: [
             'Microsoft-InsightsMetrics'
           ]
         }
-      ]
-      windowsEventLogs: [
         {
-          name: 'eventLogsDataSource'
+          destinations: [
+            '<logAnalyticsWorkspaceName>'
+          ]
           streams: [
             'Microsoft-Event'
           ]
-          xPathQueries: [
-            'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
-            'Security!*[System[(band(Keywords,13510798882111488))]]'
-            'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
-          ]
         }
       ]
-    }
-    destinations: {
-      azureMonitorMetrics: {
-        name: 'azureMonitorMetrics-default'
+      dataSources: {
+        performanceCounters: [
+          {
+            counterSpecifiers: [
+              '\\LogicalDisk(_Total)\\% Disk Read Time'
+              '\\LogicalDisk(_Total)\\% Disk Time'
+              '\\LogicalDisk(_Total)\\% Disk Write Time'
+              '\\LogicalDisk(_Total)\\% Free Space'
+              '\\LogicalDisk(_Total)\\% Idle Time'
+              '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+              '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+              '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+              '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Reads/sec'
+              '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+              '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Writes/sec'
+              '\\LogicalDisk(_Total)\\Free Megabytes'
+              '\\Memory\\% Committed Bytes In Use'
+              '\\Memory\\Available Bytes'
+              '\\Memory\\Cache Bytes'
+              '\\Memory\\Committed Bytes'
+              '\\Memory\\Page Faults/sec'
+              '\\Memory\\Pages/sec'
+              '\\Memory\\Pool Nonpaged Bytes'
+              '\\Memory\\Pool Paged Bytes'
+              '\\Network Interface(*)\\Bytes Received/sec'
+              '\\Network Interface(*)\\Bytes Sent/sec'
+              '\\Network Interface(*)\\Bytes Total/sec'
+              '\\Network Interface(*)\\Packets Outbound Errors'
+              '\\Network Interface(*)\\Packets Received Errors'
+              '\\Network Interface(*)\\Packets Received/sec'
+              '\\Network Interface(*)\\Packets Sent/sec'
+              '\\Network Interface(*)\\Packets/sec'
+              '\\Process(_Total)\\Handle Count'
+              '\\Process(_Total)\\Thread Count'
+              '\\Process(_Total)\\Working Set'
+              '\\Process(_Total)\\Working Set - Private'
+              '\\Processor Information(_Total)\\% Privileged Time'
+              '\\Processor Information(_Total)\\% Processor Time'
+              '\\Processor Information(_Total)\\% User Time'
+              '\\Processor Information(_Total)\\Processor Frequency'
+              '\\System\\Context Switches/sec'
+              '\\System\\Processes'
+              '\\System\\Processor Queue Length'
+              '\\System\\System Up Time'
+            ]
+            name: 'perfCounterDataSource60'
+            samplingFrequencyInSeconds: 60
+            streams: [
+              'Microsoft-InsightsMetrics'
+            ]
+          }
+        ]
+        windowsEventLogs: [
+          {
+            name: 'eventLogsDataSource'
+            streams: [
+              'Microsoft-Event'
+            ]
+            xPathQueries: [
+              'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+              'Security!*[System[(band(Keywords,13510798882111488))]]'
+              'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+            ]
+          }
+        ]
       }
-      logAnalytics: [
-        {
-          name: '<name>'
-          workspaceResourceId: '<workspaceResourceId>'
+      description: 'Collecting Windows-specific performance counters and Windows Event Logs'
+      destinations: {
+        azureMonitorMetrics: {
+          name: 'azureMonitorMetrics-default'
         }
-      ]
+        logAnalytics: [
+          {
+            name: '<name>'
+            workspaceResourceId: '<workspaceResourceId>'
+          }
+        ]
+      }
+      kind: 'Windows'
     }
     name: 'idcrwin001'
     // Non-required parameters
-    description: 'Collecting Windows-specific performance counters and Windows Event Logs'
-    kind: 'Windows'
     location: '<location>'
     tags: {
       'hidden-title': 'This is visible in the resource name'
@@ -1745,123 +1782,117 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
   "contentVersion": "1.0.0.0",
   "parameters": {
     // Required parameters
-    "dataFlows": {
-      "value": [
-        {
-          "destinations": [
-            "azureMonitorMetrics-default"
-          ],
-          "streams": [
-            "Microsoft-InsightsMetrics"
-          ]
-        },
-        {
-          "destinations": [
-            "<logAnalyticsWorkspaceName>"
-          ],
-          "streams": [
-            "Microsoft-Event"
-          ]
-        }
-      ]
-    },
-    "dataSources": {
+    "dataCollectionRuleProperties": {
       "value": {
-        "performanceCounters": [
+        "dataFlows": [
           {
-            "counterSpecifiers": [
-              "\\LogicalDisk(_Total)\\% Disk Read Time",
-              "\\LogicalDisk(_Total)\\% Disk Time",
-              "\\LogicalDisk(_Total)\\% Disk Write Time",
-              "\\LogicalDisk(_Total)\\% Free Space",
-              "\\LogicalDisk(_Total)\\% Idle Time",
-              "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
-              "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
-              "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
-              "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
-              "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
-              "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
-              "\\LogicalDisk(_Total)\\Disk Bytes/sec",
-              "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
-              "\\LogicalDisk(_Total)\\Disk Reads/sec",
-              "\\LogicalDisk(_Total)\\Disk Transfers/sec",
-              "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
-              "\\LogicalDisk(_Total)\\Disk Writes/sec",
-              "\\LogicalDisk(_Total)\\Free Megabytes",
-              "\\Memory\\% Committed Bytes In Use",
-              "\\Memory\\Available Bytes",
-              "\\Memory\\Cache Bytes",
-              "\\Memory\\Committed Bytes",
-              "\\Memory\\Page Faults/sec",
-              "\\Memory\\Pages/sec",
-              "\\Memory\\Pool Nonpaged Bytes",
-              "\\Memory\\Pool Paged Bytes",
-              "\\Network Interface(*)\\Bytes Received/sec",
-              "\\Network Interface(*)\\Bytes Sent/sec",
-              "\\Network Interface(*)\\Bytes Total/sec",
-              "\\Network Interface(*)\\Packets Outbound Errors",
-              "\\Network Interface(*)\\Packets Received Errors",
-              "\\Network Interface(*)\\Packets Received/sec",
-              "\\Network Interface(*)\\Packets Sent/sec",
-              "\\Network Interface(*)\\Packets/sec",
-              "\\Process(_Total)\\Handle Count",
-              "\\Process(_Total)\\Thread Count",
-              "\\Process(_Total)\\Working Set",
-              "\\Process(_Total)\\Working Set - Private",
-              "\\Processor Information(_Total)\\% Privileged Time",
-              "\\Processor Information(_Total)\\% Processor Time",
-              "\\Processor Information(_Total)\\% User Time",
-              "\\Processor Information(_Total)\\Processor Frequency",
-              "\\System\\Context Switches/sec",
-              "\\System\\Processes",
-              "\\System\\Processor Queue Length",
-              "\\System\\System Up Time"
+            "destinations": [
+              "azureMonitorMetrics-default"
             ],
-            "name": "perfCounterDataSource60",
-            "samplingFrequencyInSeconds": 60,
             "streams": [
               "Microsoft-InsightsMetrics"
             ]
-          }
-        ],
-        "windowsEventLogs": [
+          },
           {
-            "name": "eventLogsDataSource",
+            "destinations": [
+              "<logAnalyticsWorkspaceName>"
+            ],
             "streams": [
               "Microsoft-Event"
-            ],
-            "xPathQueries": [
-              "Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]",
-              "Security!*[System[(band(Keywords,13510798882111488))]]",
-              "System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]"
             ]
           }
-        ]
-      }
-    },
-    "destinations": {
-      "value": {
-        "azureMonitorMetrics": {
-          "name": "azureMonitorMetrics-default"
+        ],
+        "dataSources": {
+          "performanceCounters": [
+            {
+              "counterSpecifiers": [
+                "\\LogicalDisk(_Total)\\% Disk Read Time",
+                "\\LogicalDisk(_Total)\\% Disk Time",
+                "\\LogicalDisk(_Total)\\% Disk Write Time",
+                "\\LogicalDisk(_Total)\\% Free Space",
+                "\\LogicalDisk(_Total)\\% Idle Time",
+                "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
+                "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
+                "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
+                "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
+                "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
+                "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
+                "\\LogicalDisk(_Total)\\Disk Bytes/sec",
+                "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
+                "\\LogicalDisk(_Total)\\Disk Reads/sec",
+                "\\LogicalDisk(_Total)\\Disk Transfers/sec",
+                "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
+                "\\LogicalDisk(_Total)\\Disk Writes/sec",
+                "\\LogicalDisk(_Total)\\Free Megabytes",
+                "\\Memory\\% Committed Bytes In Use",
+                "\\Memory\\Available Bytes",
+                "\\Memory\\Cache Bytes",
+                "\\Memory\\Committed Bytes",
+                "\\Memory\\Page Faults/sec",
+                "\\Memory\\Pages/sec",
+                "\\Memory\\Pool Nonpaged Bytes",
+                "\\Memory\\Pool Paged Bytes",
+                "\\Network Interface(*)\\Bytes Received/sec",
+                "\\Network Interface(*)\\Bytes Sent/sec",
+                "\\Network Interface(*)\\Bytes Total/sec",
+                "\\Network Interface(*)\\Packets Outbound Errors",
+                "\\Network Interface(*)\\Packets Received Errors",
+                "\\Network Interface(*)\\Packets Received/sec",
+                "\\Network Interface(*)\\Packets Sent/sec",
+                "\\Network Interface(*)\\Packets/sec",
+                "\\Process(_Total)\\Handle Count",
+                "\\Process(_Total)\\Thread Count",
+                "\\Process(_Total)\\Working Set",
+                "\\Process(_Total)\\Working Set - Private",
+                "\\Processor Information(_Total)\\% Privileged Time",
+                "\\Processor Information(_Total)\\% Processor Time",
+                "\\Processor Information(_Total)\\% User Time",
+                "\\Processor Information(_Total)\\Processor Frequency",
+                "\\System\\Context Switches/sec",
+                "\\System\\Processes",
+                "\\System\\Processor Queue Length",
+                "\\System\\System Up Time"
+              ],
+              "name": "perfCounterDataSource60",
+              "samplingFrequencyInSeconds": 60,
+              "streams": [
+                "Microsoft-InsightsMetrics"
+              ]
+            }
+          ],
+          "windowsEventLogs": [
+            {
+              "name": "eventLogsDataSource",
+              "streams": [
+                "Microsoft-Event"
+              ],
+              "xPathQueries": [
+                "Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]",
+                "Security!*[System[(band(Keywords,13510798882111488))]]",
+                "System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]"
+              ]
+            }
+          ]
         },
-        "logAnalytics": [
-          {
-            "name": "<name>",
-            "workspaceResourceId": "<workspaceResourceId>"
-          }
-        ]
+        "description": "Collecting Windows-specific performance counters and Windows Event Logs",
+        "destinations": {
+          "azureMonitorMetrics": {
+            "name": "azureMonitorMetrics-default"
+          },
+          "logAnalytics": [
+            {
+              "name": "<name>",
+              "workspaceResourceId": "<workspaceResourceId>"
+            }
+          ]
+        },
+        "kind": "Windows"
       }
     },
     "name": {
       "value": "idcrwin001"
     },
     // Non-required parameters
-    "description": {
-      "value": "Collecting Windows-specific performance counters and Windows Event Logs"
-    },
-    "kind": {
-      "value": "Windows"
-    },
     "location": {
       "value": "<location>"
     },
@@ -1885,42 +1916,22 @@ module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:<vers
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`dataFlows`](#parameter-dataflows) | array | The specification of data flows. |
-| [`dataSources`](#parameter-datasources) | object | Specification of data sources that will be collected. |
-| [`destinations`](#parameter-destinations) | object | Specification of destinations that can be used in data flows. |
+| [`dataCollectionRuleProperties`](#parameter-datacollectionruleproperties) | object | The kind of data collection rule. |
 | [`name`](#parameter-name) | string | The name of the data collection rule. The name is case insensitive. |
 
 **Optional parameters**
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`dataCollectionEndpointId`](#parameter-datacollectionendpointid) | string | The resource ID of the data collection endpoint that this rule can be used with. |
-| [`description`](#parameter-description) | string | Description of the data collection rule. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
-| [`kind`](#parameter-kind) | string | The kind of the resource. |
 | [`location`](#parameter-location) | string | Location for all Resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
-| [`streamDeclarations`](#parameter-streamdeclarations) | object | Declaration of custom streams used in this rule. |
 | [`tags`](#parameter-tags) | object | Resource tags. |
 
-### Parameter: `dataFlows`
-
-The specification of data flows.
-
-- Required: Yes
-- Type: array
-
-### Parameter: `dataSources`
-
-Specification of data sources that will be collected.
-
-- Required: Yes
-- Type: object
+### Parameter: `dataCollectionRuleProperties`
 
-### Parameter: `destinations`
-
-Specification of destinations that can be used in data flows.
+The kind of data collection rule.
 
 - Required: Yes
 - Type: object
@@ -1932,20 +1943,6 @@ The name of the data collection rule. The name is case insensitive.
 - Required: Yes
 - Type: string
 
-### Parameter: `dataCollectionEndpointId`
-
-The resource ID of the data collection endpoint that this rule can be used with.
-
-- Required: No
-- Type: string
-
-### Parameter: `description`
-
-Description of the data collection rule.
-
-- Required: No
-- Type: string
-
 ### Parameter: `enableTelemetry`
 
 Enable/Disable usage telemetry for module.
@@ -1954,21 +1951,6 @@ Enable/Disable usage telemetry for module.
 - Type: bool
 - Default: `True`
 
-### Parameter: `kind`
-
-The kind of the resource.
-
-- Required: No
-- Type: string
-- Default: `'Linux'`
-- Allowed:
-  ```Bicep
-  [
-    'Linux'
-    'Windows'
-  ]
-  ```
-
 ### Parameter: `location`
 
 Location for all Resources.
@@ -2110,13 +2092,6 @@ The principal type of the assigned principal ID.
   ]
   ```
 
-### Parameter: `streamDeclarations`
-
-Declaration of custom streams used in this rule.
-
-- Required: No
-- Type: object
-
 ### Parameter: `tags`
 
 Resource tags.
diff --git a/avm/res/insights/data-collection-rule/main.bicep b/avm/res/insights/data-collection-rule/main.bicep
index 8b96a073a9..89b4545dad 100644
--- a/avm/res/insights/data-collection-rule/main.bicep
+++ b/avm/res/insights/data-collection-rule/main.bicep
@@ -6,47 +6,25 @@ metadata owner = 'Azure/module-maintainers'
 //   Parameters   //
 // ============== //
 
-@sys.description('Required. The name of the data collection rule. The name is case insensitive.')
+@description('Required. The name of the data collection rule. The name is case insensitive.')
 param name string
 
-@sys.description('Optional. The resource ID of the data collection endpoint that this rule can be used with.')
-param dataCollectionEndpointId string?
+@description('Required. The kind of data collection rule.')
+param dataCollectionRuleProperties dataCollectionRulePropertiesType
 
-@sys.description('Required. The specification of data flows.')
-param dataFlows array
-
-@sys.description('Required. Specification of data sources that will be collected.')
-param dataSources object
-
-@sys.description('Optional. Description of the data collection rule.')
-param description string?
-
-@sys.description('Required. Specification of destinations that can be used in data flows.')
-param destinations object
-
-@sys.description('Optional. Enable/Disable usage telemetry for module.')
+@description('Optional. Enable/Disable usage telemetry for module.')
 param enableTelemetry bool = true
 
-@sys.description('Optional. The kind of the resource.')
-@allowed([
-  'Linux'
-  'Windows'
-])
-param kind string = 'Linux'
-
-@sys.description('Optional. Location for all Resources.')
+@description('Optional. Location for all Resources.')
 param location string = resourceGroup().location
 
-@sys.description('Optional. The lock settings of the service.')
+@description('Optional. The lock settings of the service.')
 param lock lockType
 
-@sys.description('Optional. Array of role assignments to create.')
+@description('Optional. Array of role assignments to create.')
 param roleAssignments roleAssignmentType
 
-@sys.description('Optional. Declaration of custom streams used in this rule.')
-param streamDeclarations object?
-
-@sys.description('Optional. Resource tags.')
+@description('Optional. Resource tags.')
 param tags object?
 
 // =============== //
@@ -97,19 +75,30 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
   }
 }
 
-resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2021-09-01-preview' = {
-  kind: kind
+resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2023-03-11' = {
+  kind: dataCollectionRuleProperties.kind
   location: location
   name: name
   tags: tags
-  properties: {
-    dataSources: dataSources
-    destinations: destinations
-    dataFlows: dataFlows
-    dataCollectionEndpointId: dataCollectionEndpointId
-    streamDeclarations: streamDeclarations
-    description: description
-  }
+  properties: union(
+    {
+      description: dataCollectionRuleProperties.?description
+    },
+    dataCollectionRuleProperties.kind == 'Linux' || dataCollectionRuleProperties.kind == 'Windows'
+      ? {
+          dataSources: dataCollectionRuleProperties.dataSources
+          dataFlows: dataCollectionRuleProperties.dataFlows
+          destinations: dataCollectionRuleProperties.destinations
+          dataCollectionEndpointId: dataCollectionRuleProperties.?dataCollectionEndpointResourceId
+          streamDeclarations: dataCollectionRuleProperties.?streamDeclarations
+        }
+      : {},
+    dataCollectionRuleProperties.kind == 'AgentSettings'
+      ? {
+          agentSettings: dataCollectionRuleProperties.agentSettings
+        }
+      : {}
+  )
 }
 
 resource dataCollectionRule_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
@@ -147,16 +136,16 @@ resource dataCollectionRule_roleAssignments 'Microsoft.Authorization/roleAssignm
 //   Outputs   //
 // =========== //
 
-@sys.description('The name of the dataCollectionRule.')
+@description('The name of the dataCollectionRule.')
 output name string = dataCollectionRule.name
 
-@sys.description('The resource ID of the dataCollectionRule.')
+@description('The resource ID of the dataCollectionRule.')
 output resourceId string = dataCollectionRule.id
 
-@sys.description('The name of the resource group the dataCollectionRule was created in.')
+@description('The name of the resource group the dataCollectionRule was created in.')
 output resourceGroupName string = resourceGroup().name
 
-@sys.description('The location the resource was deployed into.')
+@description('The location the resource was deployed into.')
 output location string = dataCollectionRule.location
 
 // =============== //
@@ -164,35 +153,111 @@ output location string = dataCollectionRule.location
 // =============== //
 
 type lockType = {
-  @sys.description('Optional. Specify the name of lock.')
+  @description('Optional. Specify the name of lock.')
   name: string?
 
-  @sys.description('Optional. Specify the type of lock.')
+  @description('Optional. Specify the type of lock.')
   kind: ('CanNotDelete' | 'ReadOnly' | 'None')?
 }?
 
 type roleAssignmentType = {
-  @sys.description('Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated.')
+  @description('Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated.')
   name: string?
 
-  @sys.description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
+  @description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
   roleDefinitionIdOrName: string
 
-  @sys.description('Required. The principal ID of the principal (user/group/identity) to assign the role to.')
+  @description('Required. The principal ID of the principal (user/group/identity) to assign the role to.')
   principalId: string
 
-  @sys.description('Optional. The principal type of the assigned principal ID.')
+  @description('Optional. The principal type of the assigned principal ID.')
   principalType: ('ServicePrincipal' | 'Group' | 'User' | 'ForeignGroup' | 'Device')?
 
-  @sys.description('Optional. The description of the role assignment.')
+  @description('Optional. The description of the role assignment.')
   description: string?
 
-  @sys.description('Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".')
+  @description('Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".')
   condition: string?
 
-  @sys.description('Optional. Version of the condition.')
+  @description('Optional. Version of the condition.')
   conditionVersion: '2.0'?
 
-  @sys.description('Optional. The Resource Id of the delegated managed identity resource.')
+  @description('Optional. The Resource Id of the delegated managed identity resource.')
   delegatedManagedIdentityResourceId: string?
 }[]?
+
+@discriminator('kind')
+type dataCollectionRulePropertiesType =
+  | linuxDcrPropertiesType
+  | windowsDcrPropertiesType
+  | agentSettingsDcrPropertiesType
+
+type linuxDcrPropertiesType = {
+  @description('Required. The platform type specifies the type of resources this rule can apply to.')
+  kind: 'Linux'
+
+  @description('Required. Specification of data sources that will be collected.')
+  dataSources: object
+
+  @description('Required. The specification of data flows.')
+  dataFlows: array
+
+  @description('Required. Specification of destinations that can be used in data flows.')
+  destinations: object
+
+  @description('Optional. The resource ID of the data collection endpoint that this rule can be used with.')
+  dataCollectionEndpointResourceId: string?
+
+  @description('Optional. Declaration of custom streams used in this rule.')
+  streamDeclarations: object?
+
+  @description('Optional. Description of the data collection rule.')
+  description: string?
+}
+
+type windowsDcrPropertiesType = {
+  @description('Required. The platform type specifies the type of resources this rule can apply to.')
+  kind: 'Windows'
+
+  @description('Required. Specification of data sources that will be collected.')
+  dataSources: object
+
+  @description('Required. The specification of data flows.')
+  dataFlows: array
+
+  @description('Required. Specification of destinations that can be used in data flows.')
+  destinations: object
+
+  @description('Optional. The resource ID of the data collection endpoint that this rule can be used with.')
+  dataCollectionEndpointResourceId: string?
+
+  @description('Optional. Declaration of custom streams used in this rule.')
+  streamDeclarations: object?
+
+  @description('Optional. Description of the data collection rule.')
+  description: string?
+}
+
+type agentSettingsDcrPropertiesType = {
+  @description('Required. The platform type specifies the type of resources this rule can apply to.')
+  kind: 'AgentSettings'
+
+  @description('Optional. Description of the data collection rule.')
+  description: string?
+
+  @description('Required. Agent settings used to modify agent behavior on a given host.')
+  agentSettings: agentSettingsType
+}
+
+type agentSettingsType = {
+  @description('Required. All the settings that are applicable to the logs agent (AMA).')
+  logs: agentSettingType[]
+}
+
+type agentSettingType = {
+  @description('Required. The name of the agent setting.')
+  name: ('MaxDiskQuotaInMB' | 'UseTimeReceivedForForwardedEvents')
+
+  @description('Required. The value of the agent setting.')
+  value: string
+}
diff --git a/avm/res/insights/data-collection-rule/main.json b/avm/res/insights/data-collection-rule/main.json
index b99593c573..a891f4395a 100644
--- a/avm/res/insights/data-collection-rule/main.json
+++ b/avm/res/insights/data-collection-rule/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13184524760716789561"
+      "templateHash": "5321768196426375483"
     },
     "name": "Data Collection Rules",
     "description": "This module deploys a Data Collection Rule.",
@@ -110,45 +110,204 @@
         }
       },
       "nullable": true
-    }
-  },
-  "parameters": {
-    "name": {
-      "type": "string",
-      "metadata": {
-        "description": "Required. The name of the data collection rule. The name is case insensitive."
+    },
+    "dataCollectionRulePropertiesType": {
+      "type": "object",
+      "discriminator": {
+        "propertyName": "kind",
+        "mapping": {
+          "Linux": {
+            "$ref": "#/definitions/linuxDcrPropertiesType"
+          },
+          "Windows": {
+            "$ref": "#/definitions/windowsDcrPropertiesType"
+          },
+          "AgentSettings": {
+            "$ref": "#/definitions/agentSettingsDcrPropertiesType"
+          }
+        }
       }
     },
-    "dataCollectionEndpointId": {
-      "type": "string",
-      "nullable": true,
-      "metadata": {
-        "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+    "linuxDcrPropertiesType": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "allowedValues": [
+            "Linux"
+          ],
+          "metadata": {
+            "description": "Required. The platform type specifies the type of resources this rule can apply to."
+          }
+        },
+        "dataSources": {
+          "type": "object",
+          "metadata": {
+            "description": "Required. Specification of data sources that will be collected."
+          }
+        },
+        "dataFlows": {
+          "type": "array",
+          "metadata": {
+            "description": "Required. The specification of data flows."
+          }
+        },
+        "destinations": {
+          "type": "object",
+          "metadata": {
+            "description": "Required. Specification of destinations that can be used in data flows."
+          }
+        },
+        "dataCollectionEndpointResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+          }
+        },
+        "streamDeclarations": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Declaration of custom streams used in this rule."
+          }
+        },
+        "description": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Description of the data collection rule."
+          }
+        }
       }
     },
-    "dataFlows": {
-      "type": "array",
-      "metadata": {
-        "description": "Required. The specification of data flows."
+    "windowsDcrPropertiesType": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "allowedValues": [
+            "Windows"
+          ],
+          "metadata": {
+            "description": "Required. The platform type specifies the type of resources this rule can apply to."
+          }
+        },
+        "dataSources": {
+          "type": "object",
+          "metadata": {
+            "description": "Required. Specification of data sources that will be collected."
+          }
+        },
+        "dataFlows": {
+          "type": "array",
+          "metadata": {
+            "description": "Required. The specification of data flows."
+          }
+        },
+        "destinations": {
+          "type": "object",
+          "metadata": {
+            "description": "Required. Specification of destinations that can be used in data flows."
+          }
+        },
+        "dataCollectionEndpointResourceId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+          }
+        },
+        "streamDeclarations": {
+          "type": "object",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Declaration of custom streams used in this rule."
+          }
+        },
+        "description": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Description of the data collection rule."
+          }
+        }
       }
     },
-    "dataSources": {
+    "agentSettingsDcrPropertiesType": {
       "type": "object",
-      "metadata": {
-        "description": "Required. Specification of data sources that will be collected."
+      "properties": {
+        "kind": {
+          "type": "string",
+          "allowedValues": [
+            "AgentSettings"
+          ],
+          "metadata": {
+            "description": "Required. The platform type specifies the type of resources this rule can apply to."
+          }
+        },
+        "description": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Description of the data collection rule."
+          }
+        },
+        "agentSettings": {
+          "$ref": "#/definitions/agentSettingsType",
+          "metadata": {
+            "description": "Required. Agent settings used to modify agent behavior on a given host."
+          }
+        }
       }
     },
-    "description": {
+    "agentSettingsType": {
+      "type": "object",
+      "properties": {
+        "logs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/agentSettingType"
+          },
+          "metadata": {
+            "description": "Required. All the settings that are applicable to the logs agent (AMA)."
+          }
+        }
+      }
+    },
+    "agentSettingType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "allowedValues": [
+            "MaxDiskQuotaInMB",
+            "UseTimeReceivedForForwardedEvents"
+          ],
+          "metadata": {
+            "description": "Required. The name of the agent setting."
+          }
+        },
+        "value": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The value of the agent setting."
+          }
+        }
+      }
+    }
+  },
+  "parameters": {
+    "name": {
       "type": "string",
-      "nullable": true,
       "metadata": {
-        "description": "Optional. Description of the data collection rule."
+        "description": "Required. The name of the data collection rule. The name is case insensitive."
       }
     },
-    "destinations": {
-      "type": "object",
+    "dataCollectionRuleProperties": {
+      "$ref": "#/definitions/dataCollectionRulePropertiesType",
       "metadata": {
-        "description": "Required. Specification of destinations that can be used in data flows."
+        "description": "Required. The kind of data collection rule."
       }
     },
     "enableTelemetry": {
@@ -158,17 +317,6 @@
         "description": "Optional. Enable/Disable usage telemetry for module."
       }
     },
-    "kind": {
-      "type": "string",
-      "defaultValue": "Linux",
-      "allowedValues": [
-        "Linux",
-        "Windows"
-      ],
-      "metadata": {
-        "description": "Optional. The kind of the resource."
-      }
-    },
     "location": {
       "type": "string",
       "defaultValue": "[resourceGroup().location]",
@@ -188,13 +336,6 @@
         "description": "Optional. Array of role assignments to create."
       }
     },
-    "streamDeclarations": {
-      "type": "object",
-      "nullable": true,
-      "metadata": {
-        "description": "Optional. Declaration of custom streams used in this rule."
-      }
-    },
     "tags": {
       "type": "object",
       "nullable": true,
@@ -242,19 +383,12 @@
     },
     "dataCollectionRule": {
       "type": "Microsoft.Insights/dataCollectionRules",
-      "apiVersion": "2021-09-01-preview",
+      "apiVersion": "2023-03-11",
       "name": "[parameters('name')]",
-      "kind": "[parameters('kind')]",
+      "kind": "[parameters('dataCollectionRuleProperties').kind]",
       "location": "[parameters('location')]",
       "tags": "[parameters('tags')]",
-      "properties": {
-        "dataSources": "[parameters('dataSources')]",
-        "destinations": "[parameters('destinations')]",
-        "dataFlows": "[parameters('dataFlows')]",
-        "dataCollectionEndpointId": "[parameters('dataCollectionEndpointId')]",
-        "streamDeclarations": "[parameters('streamDeclarations')]",
-        "description": "[parameters('description')]"
-      }
+      "properties": "[union(createObject('description', tryGet(parameters('dataCollectionRuleProperties'), 'description')), if(or(equals(parameters('dataCollectionRuleProperties').kind, 'Linux'), equals(parameters('dataCollectionRuleProperties').kind, 'Windows')), createObject('dataSources', parameters('dataCollectionRuleProperties').dataSources, 'dataFlows', parameters('dataCollectionRuleProperties').dataFlows, 'destinations', parameters('dataCollectionRuleProperties').destinations, 'dataCollectionEndpointId', tryGet(parameters('dataCollectionRuleProperties'), 'dataCollectionEndpointResourceId'), 'streamDeclarations', tryGet(parameters('dataCollectionRuleProperties'), 'streamDeclarations')), createObject()), if(equals(parameters('dataCollectionRuleProperties').kind, 'AgentSettings'), createObject('agentSettings', parameters('dataCollectionRuleProperties').agentSettings), createObject()))]"
     },
     "dataCollectionRule_lock": {
       "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
@@ -320,7 +454,7 @@
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('dataCollectionRule', '2021-09-01-preview', 'full').location]"
+      "value": "[reference('dataCollectionRule', '2023-03-11', 'full').location]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/agent-settings/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/agent-settings/main.test.bicep
new file mode 100644
index 0000000000..b618848eb8
--- /dev/null
+++ b/avm/res/insights/data-collection-rule/tests/e2e/agent-settings/main.test.bicep
@@ -0,0 +1,59 @@
+targetScope = 'subscription'
+
+metadata name = 'Agent Settings'
+metadata description = 'This instance deploys the module AMA (Azure Monitor Agent) Settings DCR.'
+
+// ========== //
+// Parameters //
+// ========== //
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-insights.dataCollectionRules-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'idcrags'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// =========== //
+// Deployments //
+// =========== //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      dataCollectionRuleProperties: {
+        kind: 'AgentSettings'
+        description: 'Agent Settings'
+        agentSettings: {
+          logs: [
+            {
+              name: 'MaxDiskQuotaInMB'
+              value: '5000'
+            }
+          ]
+        }
+      }
+    }
+  }
+]
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/customadv/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/customadv/main.test.bicep
index 6eb2366a0b..97004509b5 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/customadv/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/customadv/main.test.bicep
@@ -52,79 +52,81 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      dataCollectionEndpointId: nestedDependencies.outputs.dataCollectionEndpointResourceId
-      description: 'Collecting custom text logs with ingestion-time transformation to columns. Expected format of a log line (comma separated values): "<DateTime>,<EventLevel>,<EventCode>,<Message>", for example: "2023-01-25T20:15:05Z,ERROR,404,Page not found"'
-      dataFlows: [
-        {
-          streams: [
-            'Custom-CustomTableAdvanced_CL'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-          transformKql: 'source | extend LogFields = split(RawData, ",") | extend EventTime = todatetime(LogFields[0]) | extend EventLevel = tostring(LogFields[1]) | extend EventCode = toint(LogFields[2]) | extend Message = tostring(LogFields[3]) | project TimeGenerated, EventTime, EventLevel, EventCode, Message'
-          outputStream: 'Custom-CustomTableAdvanced_CL'
-        }
-      ]
-      dataSources: {
-        logFiles: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        dataCollectionEndpointResourceId: nestedDependencies.outputs.dataCollectionEndpointResourceId
+        description: 'Collecting custom text logs with ingestion-time transformation to columns. Expected format of a log line (comma separated values): "<DateTime>,<EventLevel>,<EventCode>,<Message>", for example: "2023-01-25T20:15:05Z,ERROR,404,Page not found"'
+        dataFlows: [
           {
-            name: 'CustomTableAdvanced_CL'
-            samplingFrequencyInSeconds: 60
             streams: [
               'Custom-CustomTableAdvanced_CL'
             ]
-            filePatterns: [
-              'C:\\TestLogsAdvanced\\TestLog*.log'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
-            format: 'text'
-            settings: {
-              text: {
-                recordStartTimestampFormat: 'ISO 8601'
-              }
-            }
-          }
-        ]
-      }
-      destinations: {
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
+            transformKql: 'source | extend LogFields = split(RawData, ",") | extend EventTime = todatetime(LogFields[0]) | extend EventLevel = tostring(LogFields[1]) | extend EventCode = toint(LogFields[2]) | extend Message = tostring(LogFields[3]) | project TimeGenerated, EventTime, EventLevel, EventCode, Message'
+            outputStream: 'Custom-CustomTableAdvanced_CL'
           }
         ]
-      }
-      streamDeclarations: {
-        'Custom-CustomTableAdvanced_CL': {
-          columns: [
-            {
-              name: 'TimeGenerated'
-              type: 'datetime'
-            }
-            {
-              name: 'EventTime'
-              type: 'datetime'
-            }
+        dataSources: {
+          logFiles: [
             {
-              name: 'EventLevel'
-              type: 'string'
-            }
-            {
-              name: 'EventCode'
-              type: 'int'
-            }
-            {
-              name: 'Message'
-              type: 'string'
+              name: 'CustomTableAdvanced_CL'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Custom-CustomTableAdvanced_CL'
+              ]
+              filePatterns: [
+                'C:\\TestLogsAdvanced\\TestLog*.log'
+              ]
+              format: 'text'
+              settings: {
+                text: {
+                  recordStartTimestampFormat: 'ISO 8601'
+                }
+              }
             }
+          ]
+        }
+        destinations: {
+          logAnalytics: [
             {
-              name: 'RawData'
-              type: 'string'
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
             }
           ]
         }
+        streamDeclarations: {
+          'Custom-CustomTableAdvanced_CL': {
+            columns: [
+              {
+                name: 'TimeGenerated'
+                type: 'datetime'
+              }
+              {
+                name: 'EventTime'
+                type: 'datetime'
+              }
+              {
+                name: 'EventLevel'
+                type: 'string'
+              }
+              {
+                name: 'EventCode'
+                type: 'int'
+              }
+              {
+                name: 'Message'
+                type: 'string'
+              }
+              {
+                name: 'RawData'
+                type: 'string'
+              }
+            ]
+          }
+        }
       }
-      kind: 'Windows'
       tags: {
         'hidden-title': 'This is visible in the resource name'
         resourceType: 'Data Collection Rules'
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/custombasic/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/custombasic/main.test.bicep
index cf1e2a9b3c..88cca8c40e 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/custombasic/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/custombasic/main.test.bicep
@@ -52,63 +52,65 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      dataCollectionEndpointId: nestedDependencies.outputs.dataCollectionEndpointResourceId
-      description: 'Collecting custom text logs without ingestion-time transformation.'
-      dataFlows: [
-        {
-          streams: [
-            'Custom-CustomTableBasic_CL'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-          transformKql: 'source'
-          outputStream: 'Custom-CustomTableBasic_CL'
-        }
-      ]
-      dataSources: {
-        logFiles: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        dataCollectionEndpointResourceId: nestedDependencies.outputs.dataCollectionEndpointResourceId
+        description: 'Collecting custom text logs without ingestion-time transformation.'
+        dataFlows: [
           {
-            name: 'CustomTableBasic_CL'
-            samplingFrequencyInSeconds: 60
             streams: [
               'Custom-CustomTableBasic_CL'
             ]
-            filePatterns: [
-              'C:\\TestLogsBasic\\TestLog*.log'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
-            format: 'text'
-            settings: {
-              text: {
-                recordStartTimestampFormat: 'ISO 8601'
-              }
-            }
-          }
-        ]
-      }
-      destinations: {
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
+            transformKql: 'source'
+            outputStream: 'Custom-CustomTableBasic_CL'
           }
         ]
-      }
-      streamDeclarations: {
-        'Custom-CustomTableBasic_CL': {
-          columns: [
+        dataSources: {
+          logFiles: [
             {
-              name: 'TimeGenerated'
-              type: 'datetime'
+              name: 'CustomTableBasic_CL'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Custom-CustomTableBasic_CL'
+              ]
+              filePatterns: [
+                'C:\\TestLogsBasic\\TestLog*.log'
+              ]
+              format: 'text'
+              settings: {
+                text: {
+                  recordStartTimestampFormat: 'ISO 8601'
+                }
+              }
             }
+          ]
+        }
+        destinations: {
+          logAnalytics: [
             {
-              name: 'RawData'
-              type: 'string'
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
             }
           ]
         }
+        streamDeclarations: {
+          'Custom-CustomTableBasic_CL': {
+            columns: [
+              {
+                name: 'TimeGenerated'
+                type: 'datetime'
+              }
+              {
+                name: 'RawData'
+                type: 'string'
+              }
+            ]
+          }
+        }
       }
-      kind: 'Windows'
       tags: {
         'hidden-title': 'This is visible in the resource name'
         resourceType: 'Data Collection Rules'
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/customiis/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/customiis/main.test.bicep
index fa08fbf64c..017061171a 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/customiis/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/customiis/main.test.bicep
@@ -52,42 +52,44 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      dataCollectionEndpointId: nestedDependencies.outputs.dataCollectionEndpointResourceId
-      description: 'Collecting IIS logs.'
-      dataFlows: [
-        {
-          streams: [
-            'Microsoft-W3CIISLog'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-          transformKql: 'source'
-          outputStream: 'Microsoft-W3CIISLog'
-        }
-      ]
-      dataSources: {
-        iisLogs: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        dataCollectionEndpointResourceId: nestedDependencies.outputs.dataCollectionEndpointResourceId
+        description: 'Collecting IIS logs.'
+        dataFlows: [
           {
-            name: 'iisLogsDataSource'
             streams: [
               'Microsoft-W3CIISLog'
             ]
-            logDirectories: [
-              'C:\\inetpub\\logs\\LogFiles\\W3SVC1'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
+            transformKql: 'source'
+            outputStream: 'Microsoft-W3CIISLog'
           }
         ]
+        dataSources: {
+          iisLogs: [
+            {
+              name: 'iisLogsDataSource'
+              streams: [
+                'Microsoft-W3CIISLog'
+              ]
+              logDirectories: [
+                'C:\\inetpub\\logs\\LogFiles\\W3SVC1'
+              ]
+            }
+          ]
+        }
+        destinations: {
+          logAnalytics: [
+            {
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
+            }
+          ]
+        }
       }
-      destinations: {
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
-          }
-        ]
-      }
-      kind: 'Windows'
       tags: {
         'hidden-title': 'This is visible in the resource name'
         resourceType: 'Data Collection Rules'
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/defaults/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/defaults/main.test.bicep
index 8a9070c88e..6c6fd466da 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/defaults/main.test.bicep
@@ -42,45 +42,47 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      dataSources: {
-        performanceCounters: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        dataSources: {
+          performanceCounters: [
+            {
+              name: 'perfCounterDataSource60'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Microsoft-InsightsMetrics'
+              ]
+              counterSpecifiers: [
+                '\\Processor Information(_Total)\\% Processor Time'
+                '\\Processor Information(_Total)\\% Privileged Time'
+                '\\Processor Information(_Total)\\% User Time'
+                '\\Processor Information(_Total)\\Processor Frequency'
+                '\\System\\Processes'
+                '\\Process(_Total)\\Thread Count'
+                '\\Process(_Total)\\Handle Count'
+                '\\System\\System Up Time'
+                '\\System\\Context Switches/sec'
+                '\\System\\Processor Queue Length'
+              ]
+            }
+          ]
+        }
+        destinations: {
+          azureMonitorMetrics: {
+            name: 'azureMonitorMetrics-default'
+          }
+        }
+        dataFlows: [
           {
-            name: 'perfCounterDataSource60'
-            samplingFrequencyInSeconds: 60
             streams: [
               'Microsoft-InsightsMetrics'
             ]
-            counterSpecifiers: [
-              '\\Processor Information(_Total)\\% Processor Time'
-              '\\Processor Information(_Total)\\% Privileged Time'
-              '\\Processor Information(_Total)\\% User Time'
-              '\\Processor Information(_Total)\\Processor Frequency'
-              '\\System\\Processes'
-              '\\Process(_Total)\\Thread Count'
-              '\\Process(_Total)\\Handle Count'
-              '\\System\\System Up Time'
-              '\\System\\Context Switches/sec'
-              '\\System\\Processor Queue Length'
+            destinations: [
+              'azureMonitorMetrics-default'
             ]
           }
         ]
       }
-      destinations: {
-        azureMonitorMetrics: {
-          name: 'azureMonitorMetrics-default'
-        }
-      }
-      dataFlows: [
-        {
-          streams: [
-            'Microsoft-InsightsMetrics'
-          ]
-          destinations: [
-            'azureMonitorMetrics-default'
-          ]
-        }
-      ]
-      kind: 'Windows'
     }
   }
 ]
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/linux/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/linux/main.test.bicep
index 7ffc209efb..0371f75541 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/linux/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/linux/main.test.bicep
@@ -51,155 +51,157 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      description: 'Collecting Linux-specific performance counters and Linux Syslog'
-      dataSources: {
-        performanceCounters: [
-          {
-            name: 'perfCounterDataSource60'
-            samplingFrequencyInSeconds: 60
-            streams: [
-              'Microsoft-InsightsMetrics'
-            ]
-            counterSpecifiers: [
-              'Processor(*)\\% Processor Time'
-              'Processor(*)\\% Idle Time'
-              'Processor(*)\\% User Time'
-              'Processor(*)\\% Nice Time'
-              'Processor(*)\\% Privileged Time'
-              'Processor(*)\\% IO Wait Time'
-              'Processor(*)\\% Interrupt Time'
-              'Processor(*)\\% DPC Time'
-              'Memory(*)\\Available MBytes Memory'
-              'Memory(*)\\% Available Memory'
-              'Memory(*)\\Used Memory MBytes'
-              'Memory(*)\\% Used Memory'
-              'Memory(*)\\Pages/sec'
-              'Memory(*)\\Page Reads/sec'
-              'Memory(*)\\Page Writes/sec'
-              'Memory(*)\\Available MBytes Swap'
-              'Memory(*)\\% Available Swap Space'
-              'Memory(*)\\Used MBytes Swap Space'
-              'Memory(*)\\% Used Swap Space'
-              'Logical Disk(*)\\% Free Inodes'
-              'Logical Disk(*)\\% Used Inodes'
-              'Logical Disk(*)\\Free Megabytes'
-              'Logical Disk(*)\\% Free Space'
-              'Logical Disk(*)\\% Used Space'
-              'Logical Disk(*)\\Logical Disk Bytes/sec'
-              'Logical Disk(*)\\Disk Read Bytes/sec'
-              'Logical Disk(*)\\Disk Write Bytes/sec'
-              'Logical Disk(*)\\Disk Transfers/sec'
-              'Logical Disk(*)\\Disk Reads/sec'
-              'Logical Disk(*)\\Disk Writes/sec'
-              'Network(*)\\Total Bytes Transmitted'
-              'Network(*)\\Total Bytes Received'
-              'Network(*)\\Total Bytes'
-              'Network(*)\\Total Packets Transmitted'
-              'Network(*)\\Total Packets Received'
-              'Network(*)\\Total Rx Errors'
-              'Network(*)\\Total Tx Errors'
-              'Network(*)\\Total Collisions'
-            ]
-          }
-        ]
-        syslog: [
-          {
-            name: 'sysLogsDataSource-debugLevel'
-            streams: [
-              'Microsoft-Syslog'
-            ]
-            facilityNames: [
-              'auth'
-              'authpriv'
-            ]
-            logLevels: [
-              'Debug'
-              'Info'
-              'Notice'
-              'Warning'
-              'Error'
-              'Critical'
-              'Alert'
-              'Emergency'
-            ]
+      dataCollectionRuleProperties: {
+        kind: 'Linux'
+        description: 'Collecting Linux-specific performance counters and Linux Syslog'
+        dataSources: {
+          performanceCounters: [
+            {
+              name: 'perfCounterDataSource60'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Microsoft-InsightsMetrics'
+              ]
+              counterSpecifiers: [
+                'Processor(*)\\% Processor Time'
+                'Processor(*)\\% Idle Time'
+                'Processor(*)\\% User Time'
+                'Processor(*)\\% Nice Time'
+                'Processor(*)\\% Privileged Time'
+                'Processor(*)\\% IO Wait Time'
+                'Processor(*)\\% Interrupt Time'
+                'Processor(*)\\% DPC Time'
+                'Memory(*)\\Available MBytes Memory'
+                'Memory(*)\\% Available Memory'
+                'Memory(*)\\Used Memory MBytes'
+                'Memory(*)\\% Used Memory'
+                'Memory(*)\\Pages/sec'
+                'Memory(*)\\Page Reads/sec'
+                'Memory(*)\\Page Writes/sec'
+                'Memory(*)\\Available MBytes Swap'
+                'Memory(*)\\% Available Swap Space'
+                'Memory(*)\\Used MBytes Swap Space'
+                'Memory(*)\\% Used Swap Space'
+                'Logical Disk(*)\\% Free Inodes'
+                'Logical Disk(*)\\% Used Inodes'
+                'Logical Disk(*)\\Free Megabytes'
+                'Logical Disk(*)\\% Free Space'
+                'Logical Disk(*)\\% Used Space'
+                'Logical Disk(*)\\Logical Disk Bytes/sec'
+                'Logical Disk(*)\\Disk Read Bytes/sec'
+                'Logical Disk(*)\\Disk Write Bytes/sec'
+                'Logical Disk(*)\\Disk Transfers/sec'
+                'Logical Disk(*)\\Disk Reads/sec'
+                'Logical Disk(*)\\Disk Writes/sec'
+                'Network(*)\\Total Bytes Transmitted'
+                'Network(*)\\Total Bytes Received'
+                'Network(*)\\Total Bytes'
+                'Network(*)\\Total Packets Transmitted'
+                'Network(*)\\Total Packets Received'
+                'Network(*)\\Total Rx Errors'
+                'Network(*)\\Total Tx Errors'
+                'Network(*)\\Total Collisions'
+              ]
+            }
+          ]
+          syslog: [
+            {
+              name: 'sysLogsDataSource-debugLevel'
+              streams: [
+                'Microsoft-Syslog'
+              ]
+              facilityNames: [
+                'auth'
+                'authpriv'
+              ]
+              logLevels: [
+                'Debug'
+                'Info'
+                'Notice'
+                'Warning'
+                'Error'
+                'Critical'
+                'Alert'
+                'Emergency'
+              ]
+            }
+            {
+              name: 'sysLogsDataSource-warningLevel'
+              streams: [
+                'Microsoft-Syslog'
+              ]
+              facilityNames: [
+                'cron'
+                'daemon'
+                'mark'
+                'kern'
+                'local0'
+              ]
+              logLevels: [
+                'Warning'
+                'Error'
+                'Critical'
+                'Alert'
+                'Emergency'
+              ]
+            }
+            {
+              name: 'sysLogsDataSource-errLevel'
+              streams: [
+                'Microsoft-Syslog'
+              ]
+              facilityNames: [
+                'local1'
+                'local2'
+                'local3'
+                'local4'
+                'local5'
+                'local6'
+                'local7'
+                'lpr'
+                'mail'
+                'news'
+                'syslog'
+              ]
+              logLevels: [
+                'Error'
+                'Critical'
+                'Alert'
+                'Emergency'
+              ]
+            }
+          ]
+        }
+        destinations: {
+          azureMonitorMetrics: {
+            name: 'azureMonitorMetrics-default'
           }
+          logAnalytics: [
+            {
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
+            }
+          ]
+        }
+        dataFlows: [
           {
-            name: 'sysLogsDataSource-warningLevel'
             streams: [
-              'Microsoft-Syslog'
-            ]
-            facilityNames: [
-              'cron'
-              'daemon'
-              'mark'
-              'kern'
-              'local0'
+              'Microsoft-InsightsMetrics'
             ]
-            logLevels: [
-              'Warning'
-              'Error'
-              'Critical'
-              'Alert'
-              'Emergency'
+            destinations: [
+              'azureMonitorMetrics-default'
             ]
           }
           {
-            name: 'sysLogsDataSource-errLevel'
             streams: [
               'Microsoft-Syslog'
             ]
-            facilityNames: [
-              'local1'
-              'local2'
-              'local3'
-              'local4'
-              'local5'
-              'local6'
-              'local7'
-              'lpr'
-              'mail'
-              'news'
-              'syslog'
-            ]
-            logLevels: [
-              'Error'
-              'Critical'
-              'Alert'
-              'Emergency'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
           }
         ]
       }
-      destinations: {
-        azureMonitorMetrics: {
-          name: 'azureMonitorMetrics-default'
-        }
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
-          }
-        ]
-      }
-      dataFlows: [
-        {
-          streams: [
-            'Microsoft-InsightsMetrics'
-          ]
-          destinations: [
-            'azureMonitorMetrics-default'
-          ]
-        }
-        {
-          streams: [
-            'Microsoft-Syslog'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-        }
-      ]
-      kind: 'Linux'
       tags: {
         'hidden-title': 'This is visible in the resource name'
         resourceType: 'Data Collection Rules'
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/max/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/max/main.test.bicep
index 9cb397571f..27ac14b5c4 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/max/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/max/main.test.bicep
@@ -53,63 +53,65 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      dataCollectionEndpointId: nestedDependencies.outputs.dataCollectionEndpointResourceId
-      description: 'Collecting custom text logs without ingestion-time transformation.'
-      dataFlows: [
-        {
-          streams: [
-            'Custom-CustomTableBasic_CL'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-          transformKql: 'source'
-          outputStream: 'Custom-CustomTableBasic_CL'
-        }
-      ]
-      dataSources: {
-        logFiles: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        dataCollectionEndpointResourceId: nestedDependencies.outputs.dataCollectionEndpointResourceId
+        description: 'Collecting custom text logs without ingestion-time transformation.'
+        dataFlows: [
           {
-            name: 'CustomTableBasic_CL'
-            samplingFrequencyInSeconds: 60
             streams: [
               'Custom-CustomTableBasic_CL'
             ]
-            filePatterns: [
-              'C:\\TestLogsBasic\\TestLog*.log'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
-            format: 'text'
-            settings: {
-              text: {
-                recordStartTimestampFormat: 'ISO 8601'
-              }
-            }
+            transformKql: 'source'
+            outputStream: 'Custom-CustomTableBasic_CL'
           }
         ]
-      }
-      destinations: {
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
-          }
-        ]
-      }
-      streamDeclarations: {
-        'Custom-CustomTableBasic_CL': {
-          columns: [
+        dataSources: {
+          logFiles: [
             {
-              name: 'TimeGenerated'
-              type: 'datetime'
+              name: 'CustomTableBasic_CL'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Custom-CustomTableBasic_CL'
+              ]
+              filePatterns: [
+                'C:\\TestLogsBasic\\TestLog*.log'
+              ]
+              format: 'text'
+              settings: {
+                text: {
+                  recordStartTimestampFormat: 'ISO 8601'
+                }
+              }
             }
+          ]
+        }
+        destinations: {
+          logAnalytics: [
             {
-              name: 'RawData'
-              type: 'string'
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
             }
           ]
         }
+        streamDeclarations: {
+          'Custom-CustomTableBasic_CL': {
+            columns: [
+              {
+                name: 'TimeGenerated'
+                type: 'datetime'
+              }
+              {
+                name: 'RawData'
+                type: 'string'
+              }
+            ]
+          }
+        }
       }
-      kind: 'Windows'
       lock: {
         kind: 'CanNotDelete'
         name: 'myCustomLockName'
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/waf-aligned/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/waf-aligned/main.test.bicep
index c1b93f95b5..797344b7e1 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/waf-aligned/main.test.bicep
@@ -52,109 +52,111 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      description: 'Collecting Windows-specific performance counters and Windows Event Logs'
-      dataSources: {
-        performanceCounters: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        description: 'Collecting Windows-specific performance counters and Windows Event Logs'
+        dataSources: {
+          performanceCounters: [
+            {
+              name: 'perfCounterDataSource60'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Microsoft-InsightsMetrics'
+              ]
+              counterSpecifiers: [
+                '\\Processor Information(_Total)\\% Processor Time'
+                '\\Processor Information(_Total)\\% Privileged Time'
+                '\\Processor Information(_Total)\\% User Time'
+                '\\Processor Information(_Total)\\Processor Frequency'
+                '\\System\\Processes'
+                '\\Process(_Total)\\Thread Count'
+                '\\Process(_Total)\\Handle Count'
+                '\\System\\System Up Time'
+                '\\System\\Context Switches/sec'
+                '\\System\\Processor Queue Length'
+                '\\Memory\\% Committed Bytes In Use'
+                '\\Memory\\Available Bytes'
+                '\\Memory\\Committed Bytes'
+                '\\Memory\\Cache Bytes'
+                '\\Memory\\Pool Paged Bytes'
+                '\\Memory\\Pool Nonpaged Bytes'
+                '\\Memory\\Pages/sec'
+                '\\Memory\\Page Faults/sec'
+                '\\Process(_Total)\\Working Set'
+                '\\Process(_Total)\\Working Set - Private'
+                '\\LogicalDisk(_Total)\\% Disk Time'
+                '\\LogicalDisk(_Total)\\% Disk Read Time'
+                '\\LogicalDisk(_Total)\\% Disk Write Time'
+                '\\LogicalDisk(_Total)\\% Idle Time'
+                '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+                '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+                '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+                '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+                '\\LogicalDisk(_Total)\\Disk Reads/sec'
+                '\\LogicalDisk(_Total)\\Disk Writes/sec'
+                '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+                '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+                '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+                '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+                '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+                '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+                '\\LogicalDisk(_Total)\\% Free Space'
+                '\\LogicalDisk(_Total)\\Free Megabytes'
+                '\\Network Interface(*)\\Bytes Total/sec'
+                '\\Network Interface(*)\\Bytes Sent/sec'
+                '\\Network Interface(*)\\Bytes Received/sec'
+                '\\Network Interface(*)\\Packets/sec'
+                '\\Network Interface(*)\\Packets Sent/sec'
+                '\\Network Interface(*)\\Packets Received/sec'
+                '\\Network Interface(*)\\Packets Outbound Errors'
+                '\\Network Interface(*)\\Packets Received Errors'
+              ]
+            }
+          ]
+          windowsEventLogs: [
+            {
+              name: 'eventLogsDataSource'
+              streams: [
+                'Microsoft-Event'
+              ]
+              xPathQueries: [
+                'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+                'Security!*[System[(band(Keywords,13510798882111488))]]'
+                'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+              ]
+            }
+          ]
+        }
+        destinations: {
+          azureMonitorMetrics: {
+            name: 'azureMonitorMetrics-default'
+          }
+          logAnalytics: [
+            {
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
+            }
+          ]
+        }
+        dataFlows: [
           {
-            name: 'perfCounterDataSource60'
-            samplingFrequencyInSeconds: 60
             streams: [
               'Microsoft-InsightsMetrics'
             ]
-            counterSpecifiers: [
-              '\\Processor Information(_Total)\\% Processor Time'
-              '\\Processor Information(_Total)\\% Privileged Time'
-              '\\Processor Information(_Total)\\% User Time'
-              '\\Processor Information(_Total)\\Processor Frequency'
-              '\\System\\Processes'
-              '\\Process(_Total)\\Thread Count'
-              '\\Process(_Total)\\Handle Count'
-              '\\System\\System Up Time'
-              '\\System\\Context Switches/sec'
-              '\\System\\Processor Queue Length'
-              '\\Memory\\% Committed Bytes In Use'
-              '\\Memory\\Available Bytes'
-              '\\Memory\\Committed Bytes'
-              '\\Memory\\Cache Bytes'
-              '\\Memory\\Pool Paged Bytes'
-              '\\Memory\\Pool Nonpaged Bytes'
-              '\\Memory\\Pages/sec'
-              '\\Memory\\Page Faults/sec'
-              '\\Process(_Total)\\Working Set'
-              '\\Process(_Total)\\Working Set - Private'
-              '\\LogicalDisk(_Total)\\% Disk Time'
-              '\\LogicalDisk(_Total)\\% Disk Read Time'
-              '\\LogicalDisk(_Total)\\% Disk Write Time'
-              '\\LogicalDisk(_Total)\\% Idle Time'
-              '\\LogicalDisk(_Total)\\Disk Bytes/sec'
-              '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
-              '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
-              '\\LogicalDisk(_Total)\\Disk Transfers/sec'
-              '\\LogicalDisk(_Total)\\Disk Reads/sec'
-              '\\LogicalDisk(_Total)\\Disk Writes/sec'
-              '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
-              '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
-              '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
-              '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
-              '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
-              '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
-              '\\LogicalDisk(_Total)\\% Free Space'
-              '\\LogicalDisk(_Total)\\Free Megabytes'
-              '\\Network Interface(*)\\Bytes Total/sec'
-              '\\Network Interface(*)\\Bytes Sent/sec'
-              '\\Network Interface(*)\\Bytes Received/sec'
-              '\\Network Interface(*)\\Packets/sec'
-              '\\Network Interface(*)\\Packets Sent/sec'
-              '\\Network Interface(*)\\Packets Received/sec'
-              '\\Network Interface(*)\\Packets Outbound Errors'
-              '\\Network Interface(*)\\Packets Received Errors'
+            destinations: [
+              'azureMonitorMetrics-default'
             ]
           }
-        ]
-        windowsEventLogs: [
           {
-            name: 'eventLogsDataSource'
             streams: [
               'Microsoft-Event'
             ]
-            xPathQueries: [
-              'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
-              'Security!*[System[(band(Keywords,13510798882111488))]]'
-              'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
           }
         ]
       }
-      destinations: {
-        azureMonitorMetrics: {
-          name: 'azureMonitorMetrics-default'
-        }
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
-          }
-        ]
-      }
-      dataFlows: [
-        {
-          streams: [
-            'Microsoft-InsightsMetrics'
-          ]
-          destinations: [
-            'azureMonitorMetrics-default'
-          ]
-        }
-        {
-          streams: [
-            'Microsoft-Event'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-        }
-      ]
-      kind: 'Windows'
       tags: {
         'hidden-title': 'This is visible in the resource name'
         resourceType: 'Data Collection Rules'
diff --git a/avm/res/insights/data-collection-rule/tests/e2e/windows/main.test.bicep b/avm/res/insights/data-collection-rule/tests/e2e/windows/main.test.bicep
index d5e29bfc40..7c58e5ede8 100644
--- a/avm/res/insights/data-collection-rule/tests/e2e/windows/main.test.bicep
+++ b/avm/res/insights/data-collection-rule/tests/e2e/windows/main.test.bicep
@@ -51,109 +51,111 @@ module testDeployment '../../../main.bicep' = [
     params: {
       name: '${namePrefix}${serviceShort}001'
       location: resourceLocation
-      description: 'Collecting Windows-specific performance counters and Windows Event Logs'
-      dataSources: {
-        performanceCounters: [
+      dataCollectionRuleProperties: {
+        kind: 'Windows'
+        description: 'Collecting Windows-specific performance counters and Windows Event Logs'
+        dataSources: {
+          performanceCounters: [
+            {
+              name: 'perfCounterDataSource60'
+              samplingFrequencyInSeconds: 60
+              streams: [
+                'Microsoft-InsightsMetrics'
+              ]
+              counterSpecifiers: [
+                '\\Processor Information(_Total)\\% Processor Time'
+                '\\Processor Information(_Total)\\% Privileged Time'
+                '\\Processor Information(_Total)\\% User Time'
+                '\\Processor Information(_Total)\\Processor Frequency'
+                '\\System\\Processes'
+                '\\Process(_Total)\\Thread Count'
+                '\\Process(_Total)\\Handle Count'
+                '\\System\\System Up Time'
+                '\\System\\Context Switches/sec'
+                '\\System\\Processor Queue Length'
+                '\\Memory\\% Committed Bytes In Use'
+                '\\Memory\\Available Bytes'
+                '\\Memory\\Committed Bytes'
+                '\\Memory\\Cache Bytes'
+                '\\Memory\\Pool Paged Bytes'
+                '\\Memory\\Pool Nonpaged Bytes'
+                '\\Memory\\Pages/sec'
+                '\\Memory\\Page Faults/sec'
+                '\\Process(_Total)\\Working Set'
+                '\\Process(_Total)\\Working Set - Private'
+                '\\LogicalDisk(_Total)\\% Disk Time'
+                '\\LogicalDisk(_Total)\\% Disk Read Time'
+                '\\LogicalDisk(_Total)\\% Disk Write Time'
+                '\\LogicalDisk(_Total)\\% Idle Time'
+                '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+                '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+                '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+                '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+                '\\LogicalDisk(_Total)\\Disk Reads/sec'
+                '\\LogicalDisk(_Total)\\Disk Writes/sec'
+                '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+                '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+                '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+                '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+                '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+                '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+                '\\LogicalDisk(_Total)\\% Free Space'
+                '\\LogicalDisk(_Total)\\Free Megabytes'
+                '\\Network Interface(*)\\Bytes Total/sec'
+                '\\Network Interface(*)\\Bytes Sent/sec'
+                '\\Network Interface(*)\\Bytes Received/sec'
+                '\\Network Interface(*)\\Packets/sec'
+                '\\Network Interface(*)\\Packets Sent/sec'
+                '\\Network Interface(*)\\Packets Received/sec'
+                '\\Network Interface(*)\\Packets Outbound Errors'
+                '\\Network Interface(*)\\Packets Received Errors'
+              ]
+            }
+          ]
+          windowsEventLogs: [
+            {
+              name: 'eventLogsDataSource'
+              streams: [
+                'Microsoft-Event'
+              ]
+              xPathQueries: [
+                'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+                'Security!*[System[(band(Keywords,13510798882111488))]]'
+                'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+              ]
+            }
+          ]
+        }
+        destinations: {
+          azureMonitorMetrics: {
+            name: 'azureMonitorMetrics-default'
+          }
+          logAnalytics: [
+            {
+              workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
+              name: nestedDependencies.outputs.logAnalyticsWorkspaceName
+            }
+          ]
+        }
+        dataFlows: [
           {
-            name: 'perfCounterDataSource60'
-            samplingFrequencyInSeconds: 60
             streams: [
               'Microsoft-InsightsMetrics'
             ]
-            counterSpecifiers: [
-              '\\Processor Information(_Total)\\% Processor Time'
-              '\\Processor Information(_Total)\\% Privileged Time'
-              '\\Processor Information(_Total)\\% User Time'
-              '\\Processor Information(_Total)\\Processor Frequency'
-              '\\System\\Processes'
-              '\\Process(_Total)\\Thread Count'
-              '\\Process(_Total)\\Handle Count'
-              '\\System\\System Up Time'
-              '\\System\\Context Switches/sec'
-              '\\System\\Processor Queue Length'
-              '\\Memory\\% Committed Bytes In Use'
-              '\\Memory\\Available Bytes'
-              '\\Memory\\Committed Bytes'
-              '\\Memory\\Cache Bytes'
-              '\\Memory\\Pool Paged Bytes'
-              '\\Memory\\Pool Nonpaged Bytes'
-              '\\Memory\\Pages/sec'
-              '\\Memory\\Page Faults/sec'
-              '\\Process(_Total)\\Working Set'
-              '\\Process(_Total)\\Working Set - Private'
-              '\\LogicalDisk(_Total)\\% Disk Time'
-              '\\LogicalDisk(_Total)\\% Disk Read Time'
-              '\\LogicalDisk(_Total)\\% Disk Write Time'
-              '\\LogicalDisk(_Total)\\% Idle Time'
-              '\\LogicalDisk(_Total)\\Disk Bytes/sec'
-              '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
-              '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
-              '\\LogicalDisk(_Total)\\Disk Transfers/sec'
-              '\\LogicalDisk(_Total)\\Disk Reads/sec'
-              '\\LogicalDisk(_Total)\\Disk Writes/sec'
-              '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
-              '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
-              '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
-              '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
-              '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
-              '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
-              '\\LogicalDisk(_Total)\\% Free Space'
-              '\\LogicalDisk(_Total)\\Free Megabytes'
-              '\\Network Interface(*)\\Bytes Total/sec'
-              '\\Network Interface(*)\\Bytes Sent/sec'
-              '\\Network Interface(*)\\Bytes Received/sec'
-              '\\Network Interface(*)\\Packets/sec'
-              '\\Network Interface(*)\\Packets Sent/sec'
-              '\\Network Interface(*)\\Packets Received/sec'
-              '\\Network Interface(*)\\Packets Outbound Errors'
-              '\\Network Interface(*)\\Packets Received Errors'
+            destinations: [
+              'azureMonitorMetrics-default'
             ]
           }
-        ]
-        windowsEventLogs: [
           {
-            name: 'eventLogsDataSource'
             streams: [
               'Microsoft-Event'
             ]
-            xPathQueries: [
-              'Application!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
-              'Security!*[System[(band(Keywords,13510798882111488))]]'
-              'System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]'
+            destinations: [
+              nestedDependencies.outputs.logAnalyticsWorkspaceName
             ]
           }
         ]
       }
-      destinations: {
-        azureMonitorMetrics: {
-          name: 'azureMonitorMetrics-default'
-        }
-        logAnalytics: [
-          {
-            workspaceResourceId: nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
-            name: nestedDependencies.outputs.logAnalyticsWorkspaceName
-          }
-        ]
-      }
-      dataFlows: [
-        {
-          streams: [
-            'Microsoft-InsightsMetrics'
-          ]
-          destinations: [
-            'azureMonitorMetrics-default'
-          ]
-        }
-        {
-          streams: [
-            'Microsoft-Event'
-          ]
-          destinations: [
-            nestedDependencies.outputs.logAnalyticsWorkspaceName
-          ]
-        }
-      ]
-      kind: 'Windows'
       tags: {
         'hidden-title': 'This is visible in the resource name'
         resourceType: 'Data Collection Rules'
diff --git a/avm/res/insights/data-collection-rule/version.json b/avm/res/insights/data-collection-rule/version.json
index 1c035df49f..c177b1bb58 100644
--- a/avm/res/insights/data-collection-rule/version.json
+++ b/avm/res/insights/data-collection-rule/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.2",
+    "version": "0.3",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/insights/private-link-scope/README.md b/avm/res/insights/private-link-scope/README.md
index 7a3729f7a8..9c6f5d5719 100644
--- a/avm/res/insights/private-link-scope/README.md
+++ b/avm/res/insights/private-link-scope/README.md
@@ -19,8 +19,8 @@ This module deploys an Azure Monitor Private Link Scope.
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
 | `microsoft.insights/privateLinkScopes` | [2021-07-01-preview](https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/2021-07-01-preview/privateLinkScopes) |
 | `Microsoft.Insights/privateLinkScopes/scopedResources` | [2021-07-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-07-01-preview/privateLinkScopes/scopedResources) |
-| `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
-| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 
 ## Usage examples
 
@@ -208,9 +208,13 @@ module privateLinkScope 'br/public:avm/res/insights/private-link-scope:<version>
           }
         ]
         name: 'pe-'
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             principalId: '<principalId>'
@@ -394,9 +398,13 @@ module privateLinkScope 'br/public:avm/res/insights/private-link-scope:<version>
             }
           ],
           "name": "pe-",
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "principalId": "<principalId>",
@@ -567,9 +575,13 @@ module privateLinkScope 'br/public:avm/res/insights/private-link-scope:<version>
           }
         ]
         name: 'pe-'
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -708,9 +720,13 @@ module privateLinkScope 'br/public:avm/res/insights/private-link-scope:<version>
             }
           ],
           "name": "pe-",
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -942,8 +958,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1127,19 +1142,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1404,6 +1464,7 @@ Resource tags.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the private link scope. |
+| `privateEndpoints` | array | The private endpoints of the private link scope. |
 | `resourceGroupName` | string | The resource group the private link scope was deployed into. |
 | `resourceId` | string | The resource ID of the private link scope. |
 
@@ -1413,7 +1474,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.4.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/insights/private-link-scope/main.bicep b/avm/res/insights/private-link-scope/main.bicep
index e926990853..50534b0383 100644
--- a/avm/res/insights/private-link-scope/main.bicep
+++ b/avm/res/insights/private-link-scope/main.bicep
@@ -154,7 +154,7 @@ resource privateLinkScope_lock 'Microsoft.Authorization/locks@2020-05-01' = if (
   scope: privateLinkScope
 }
 
-module privateLinkScope_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4.1' = [
+module privateLinkScope_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-privateLinkScope-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -195,8 +195,7 @@ module privateLinkScope_privateEndpoints 'br/public:avm/res/network/private-endp
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -235,6 +234,17 @@ output resourceGroupName string = resourceGroup().name
 @description('The location the resource was deployed into.')
 output location string = privateLinkScope.location
 
+@description('The private endpoints of the private link scope.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: privateLinkScope_privateEndpoints[i].outputs.name
+    resourceId: privateLinkScope_privateEndpoints[i].outputs.resourceId
+    groupId: privateLinkScope_privateEndpoints[i].outputs.groupId
+    customDnsConfig: privateLinkScope_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: privateLinkScope_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -289,11 +299,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/insights/private-link-scope/main.json b/avm/res/insights/private-link-scope/main.json
index fdb7f2a158..c1efbd235d 100644
--- a/avm/res/insights/private-link-scope/main.json
+++ b/avm/res/insights/private-link-scope/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "2401315355721407155"
+      "templateHash": "9210191494689145931"
     },
     "name": "Azure Monitor Private Link Scopes",
     "description": "This module deploys an Azure Monitor Private Link Scope.",
@@ -150,21 +150,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -678,11 +701,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -710,19 +730,47 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.25.53.49325",
-              "templateHash": "4120048060064073955"
+              "version": "0.29.47.4906",
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
                 "type": "object",
                 "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
                   "roleDefinitionIdOrName": {
                     "type": "string",
                     "metadata": {
@@ -826,13 +874,13 @@
                       "groupId": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "memberName": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "privateIPAddress": {
@@ -866,8 +914,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -907,8 +958,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -956,6 +1010,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -991,18 +1068,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1058,6 +1128,13 @@
             }
           },
           "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
             "builtInRoleNames": {
               "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
               "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
@@ -1075,8 +1152,8 @@
             "avmTelemetry": {
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2023-07-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1094,7 +1171,7 @@
             },
             "privateEndpoint": {
               "type": "Microsoft.Network/privateEndpoints",
-              "apiVersion": "2023-04-01",
+              "apiVersion": "2023-11-01",
               "name": "[parameters('name')]",
               "location": "[parameters('location')]",
               "tags": "[parameters('tags')]",
@@ -1135,27 +1212,27 @@
             "privateEndpoint_roleAssignments": {
               "copy": {
                 "name": "privateEndpoint_roleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
               },
               "type": "Microsoft.Authorization/roleAssignments",
               "apiVersion": "2022-04-01",
               "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
               "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
               },
               "dependsOn": [
                 "privateEndpoint"
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1166,28 +1243,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "11244630631275470040"
+                      "version": "0.29.47.4906",
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1195,12 +1296,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1214,27 +1318,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                      "apiVersion": "2023-04-01",
+                      "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1292,14 +1405,28 @@
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+              "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+            },
+            "customDnsConfig": {
+              "$ref": "#/definitions/customDnsConfigType",
+              "metadata": {
+                "description": "The custom DNS configurations of the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').customDnsConfigs]"
+            },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
             },
             "groupId": {
               "type": "string",
               "metadata": {
                 "description": "The group Id for the private endpoint Group."
               },
-              "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+              "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
             }
           }
         }
@@ -1337,6 +1464,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('privateLinkScope', '2021-07-01-preview', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the private link scope."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('privateLinkScope_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('privateLinkScope_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('privateLinkScope_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('privateLinkScope_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('privateLinkScope_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/insights/private-link-scope/tests/e2e/max/main.test.bicep b/avm/res/insights/private-link-scope/tests/e2e/max/main.test.bicep
index 68deb2d0a6..25c575033e 100644
--- a/avm/res/insights/private-link-scope/tests/e2e/max/main.test.bicep
+++ b/avm/res/insights/private-link-scope/tests/e2e/max/main.test.bicep
@@ -78,9 +78,13 @@ module testDeployment '../../../main.bicep' = [
           name: 'pe-${namePrefix}'
           customNetworkInterfaceName: 'nic-pe-${namePrefix}'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
diff --git a/avm/res/insights/private-link-scope/tests/e2e/waf-aligned/main.test.bicep b/avm/res/insights/private-link-scope/tests/e2e/waf-aligned/main.test.bicep
index c92cf66a1d..5a537cd3fe 100644
--- a/avm/res/insights/private-link-scope/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/insights/private-link-scope/tests/e2e/waf-aligned/main.test.bicep
@@ -65,9 +65,13 @@ module testDeployment '../../../main.bicep' = [
           name: 'pe-${namePrefix}'
           customNetworkInterfaceName: 'nic-pe-${namePrefix}'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
diff --git a/avm/res/insights/private-link-scope/version.json b/avm/res/insights/private-link-scope/version.json
index 3f863a2bec..a8eda31021 100644
--- a/avm/res/insights/private-link-scope/version.json
+++ b/avm/res/insights/private-link-scope/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.4",
+    "version": "0.5",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/insights/scheduled-query-rule/README.md b/avm/res/insights/scheduled-query-rule/README.md
index b90b6eb72d..c0f4c7a979 100644
--- a/avm/res/insights/scheduled-query-rule/README.md
+++ b/avm/res/insights/scheduled-query-rule/README.md
@@ -15,7 +15,7 @@ This module deploys a Scheduled Query Rule.
 | Resource Type | API Version |
 | :-- | :-- |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.Insights/scheduledQueryRules` | [2021-02-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-02-01-preview/scheduledQueryRules) |
+| `Microsoft.Insights/scheduledQueryRules` | [2023-03-15-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2023-03-15-preview/scheduledQueryRules) |
 
 ## Usage examples
 
@@ -196,6 +196,7 @@ module scheduledQueryRule 'br/public:avm/res/insights/scheduled-query-rule:<vers
     ]
     // Non-required parameters
     alertDescription: 'My sample Alert'
+    alertDisplayName: '<alertDisplayName>'
     autoMitigate: false
     evaluationFrequency: 'PT5M'
     location: '<location>'
@@ -219,6 +220,10 @@ module scheduledQueryRule 'br/public:avm/res/insights/scheduled-query-rule:<vers
         roleDefinitionIdOrName: '<roleDefinitionIdOrName>'
       }
     ]
+    ruleResolveConfiguration: {
+      autoResolved: true
+      timeToResolve: 'PT5M'
+    }
     suppressForMinutes: 'PT5M'
     tags: {
       Environment: 'Non-Prod'
@@ -284,6 +289,9 @@ module scheduledQueryRule 'br/public:avm/res/insights/scheduled-query-rule:<vers
     "alertDescription": {
       "value": "My sample Alert"
     },
+    "alertDisplayName": {
+      "value": "<alertDisplayName>"
+    },
     "autoMitigate": {
       "value": false
     },
@@ -317,6 +325,12 @@ module scheduledQueryRule 'br/public:avm/res/insights/scheduled-query-rule:<vers
         }
       ]
     },
+    "ruleResolveConfiguration": {
+      "value": {
+        "autoResolved": true,
+        "timeToResolve": "PT5M"
+      }
+    },
     "suppressForMinutes": {
       "value": "PT5M"
     },
@@ -507,6 +521,7 @@ module scheduledQueryRule 'br/public:avm/res/insights/scheduled-query-rule:<vers
 | :-- | :-- | :-- |
 | [`actions`](#parameter-actions) | array | Actions to invoke when the alert fires. |
 | [`alertDescription`](#parameter-alertdescription) | string | The description of the scheduled query rule. |
+| [`alertDisplayName`](#parameter-alertdisplayname) | string | The display name of the scheduled query rule. |
 | [`autoMitigate`](#parameter-automitigate) | bool | The flag that indicates whether the alert should be automatically resolved or not. Relevant only for rules of the kind LogAlert. |
 | [`enabled`](#parameter-enabled) | bool | The flag which indicates whether this scheduled query rule is enabled. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
@@ -515,6 +530,7 @@ module scheduledQueryRule 'br/public:avm/res/insights/scheduled-query-rule:<vers
 | [`location`](#parameter-location) | string | Location for all resources. |
 | [`queryTimeRange`](#parameter-querytimerange) | string | If specified (in ISO 8601 duration format) then overrides the query time range. Relevant only for rules of the kind LogAlert. |
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
+| [`ruleResolveConfiguration`](#parameter-ruleresolveconfiguration) | object | Defines the configuration for resolving fired alerts. Relevant only for rules of the kind LogAlert. |
 | [`severity`](#parameter-severity) | int | Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert. |
 | [`skipQueryValidation`](#parameter-skipqueryvalidation) | bool | The flag which indicates whether the provided query should be validated or not. Relevant only for rules of the kind LogAlert. |
 | [`suppressForMinutes`](#parameter-suppressforminutes) | string | Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. If set, autoMitigate must be disabled.Relevant only for rules of the kind LogAlert. |
@@ -566,6 +582,13 @@ The description of the scheduled query rule.
 - Type: string
 - Default: `''`
 
+### Parameter: `alertDisplayName`
+
+The display name of the scheduled query rule.
+
+- Required: No
+- Type: string
+
 ### Parameter: `autoMitigate`
 
 The flag that indicates whether the alert should be automatically resolved or not. Relevant only for rules of the kind LogAlert.
@@ -726,6 +749,13 @@ The principal type of the assigned principal ID.
   ]
   ```
 
+### Parameter: `ruleResolveConfiguration`
+
+Defines the configuration for resolving fired alerts. Relevant only for rules of the kind LogAlert.
+
+- Required: No
+- Type: object
+
 ### Parameter: `severity`
 
 Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.
diff --git a/avm/res/insights/scheduled-query-rule/main.bicep b/avm/res/insights/scheduled-query-rule/main.bicep
index ff76dbef2a..de303d5e03 100644
--- a/avm/res/insights/scheduled-query-rule/main.bicep
+++ b/avm/res/insights/scheduled-query-rule/main.bicep
@@ -11,6 +11,9 @@ param location string = resourceGroup().location
 @description('Optional. The description of the scheduled query rule.')
 param alertDescription string = ''
 
+@description('Optional. The display name of the scheduled query rule.')
+param alertDisplayName string?
+
 @description('Optional. The flag which indicates whether this scheduled query rule is enabled.')
 param enabled bool = true
 
@@ -36,6 +39,9 @@ param targetResourceTypes array = []
 @description('Optional. Array of role assignments to create.')
 param roleAssignments roleAssignmentType
 
+@description('Optional. Defines the configuration for resolving fired alerts. Relevant only for rules of the kind LogAlert.')
+param ruleResolveConfiguration object?
+
 @description('Required. The list of resource IDs that this scheduled query rule is scoped to.')
 param scopes array
 
@@ -114,7 +120,7 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
   }
 }
 
-resource queryRule 'Microsoft.Insights/scheduledQueryRules@2021-02-01-preview' = {
+resource queryRule 'Microsoft.Insights/scheduledQueryRules@2023-03-15-preview' = {
   name: name
   location: location
   tags: tags
@@ -127,11 +133,12 @@ resource queryRule 'Microsoft.Insights/scheduledQueryRules@2021-02-01-preview' =
     autoMitigate: (kind == 'LogAlert') ? autoMitigate : null
     criteria: criterias
     description: alertDescription
-    displayName: name
+    displayName: alertDisplayName ?? name
     enabled: enabled
     evaluationFrequency: (kind == 'LogAlert' && !empty(evaluationFrequency)) ? evaluationFrequency : null
     muteActionsDuration: (kind == 'LogAlert' && !empty(suppressForMinutes)) ? suppressForMinutes : null
     overrideQueryTimeRange: (kind == 'LogAlert' && !empty(queryTimeRange)) ? queryTimeRange : null
+    ruleResolveConfiguration: (kind == 'LogAlert' && !empty(ruleResolveConfiguration)) ? ruleResolveConfiguration : null
     scopes: scopes
     severity: (kind == 'LogAlert') ? severity : null
     skipQueryValidation: (kind == 'LogAlert') ? skipQueryValidation : null
diff --git a/avm/res/insights/scheduled-query-rule/main.json b/avm/res/insights/scheduled-query-rule/main.json
index 7672de275f..c79dd897c3 100644
--- a/avm/res/insights/scheduled-query-rule/main.json
+++ b/avm/res/insights/scheduled-query-rule/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "12034267134047308763"
+      "templateHash": "17672964122833676180"
     },
     "name": "Scheduled Query Rules",
     "description": "This module deploys a Scheduled Query Rule.",
@@ -108,6 +108,13 @@
         "description": "Optional. The description of the scheduled query rule."
       }
     },
+    "alertDisplayName": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The display name of the scheduled query rule."
+      }
+    },
     "enabled": {
       "type": "bool",
       "defaultValue": true,
@@ -160,6 +167,13 @@
         "description": "Optional. Array of role assignments to create."
       }
     },
+    "ruleResolveConfiguration": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Defines the configuration for resolving fired alerts. Relevant only for rules of the kind LogAlert."
+      }
+    },
     "scopes": {
       "type": "array",
       "metadata": {
@@ -268,7 +282,7 @@
     },
     "queryRule": {
       "type": "Microsoft.Insights/scheduledQueryRules",
-      "apiVersion": "2021-02-01-preview",
+      "apiVersion": "2023-03-15-preview",
       "name": "[parameters('name')]",
       "location": "[parameters('location')]",
       "tags": "[parameters('tags')]",
@@ -281,11 +295,12 @@
         "autoMitigate": "[if(equals(parameters('kind'), 'LogAlert'), parameters('autoMitigate'), null())]",
         "criteria": "[parameters('criterias')]",
         "description": "[parameters('alertDescription')]",
-        "displayName": "[parameters('name')]",
+        "displayName": "[coalesce(parameters('alertDisplayName'), parameters('name'))]",
         "enabled": "[parameters('enabled')]",
         "evaluationFrequency": "[if(and(equals(parameters('kind'), 'LogAlert'), not(empty(parameters('evaluationFrequency')))), parameters('evaluationFrequency'), null())]",
         "muteActionsDuration": "[if(and(equals(parameters('kind'), 'LogAlert'), not(empty(parameters('suppressForMinutes')))), parameters('suppressForMinutes'), null())]",
         "overrideQueryTimeRange": "[if(and(equals(parameters('kind'), 'LogAlert'), not(empty(parameters('queryTimeRange')))), parameters('queryTimeRange'), null())]",
+        "ruleResolveConfiguration": "[if(and(equals(parameters('kind'), 'LogAlert'), not(empty(parameters('ruleResolveConfiguration')))), parameters('ruleResolveConfiguration'), null())]",
         "scopes": "[parameters('scopes')]",
         "severity": "[if(equals(parameters('kind'), 'LogAlert'), parameters('severity'), null())]",
         "skipQueryValidation": "[if(equals(parameters('kind'), 'LogAlert'), parameters('skipQueryValidation'), null())]",
@@ -343,7 +358,7 @@
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('queryRule', '2021-02-01-preview', 'full').location]"
+      "value": "[reference('queryRule', '2023-03-15-preview', 'full').location]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/insights/scheduled-query-rule/tests/e2e/max/main.test.bicep b/avm/res/insights/scheduled-query-rule/tests/e2e/max/main.test.bicep
index f12b8e8168..363126f2ec 100644
--- a/avm/res/insights/scheduled-query-rule/tests/e2e/max/main.test.bicep
+++ b/avm/res/insights/scheduled-query-rule/tests/e2e/max/main.test.bicep
@@ -106,6 +106,11 @@ module testDeployment '../../../main.bicep' = [
           principalType: 'ServicePrincipal'
         }
       ]
+      alertDisplayName: '${uniqueString(deployment().name, resourceLocation)}-displayNameTest-${serviceShort}-${iteration}'
+      ruleResolveConfiguration: {
+        autoResolved: true
+        timeToResolve: 'PT5M'
+      }
       scopes: [
         nestedDependencies.outputs.logAnalyticsWorkspaceResourceId
       ]
diff --git a/avm/res/key-vault/vault/README.md b/avm/res/key-vault/vault/README.md
index abc01ea99d..10326e55cc 100644
--- a/avm/res/key-vault/vault/README.md
+++ b/avm/res/key-vault/vault/README.md
@@ -22,8 +22,8 @@ This module deploys a Key Vault.
 | `Microsoft.KeyVault/vaults/accessPolicies` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/accessPolicies) |
 | `Microsoft.KeyVault/vaults/keys` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/keys) |
 | `Microsoft.KeyVault/vaults/secrets` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2022-07-01/vaults/secrets) |
-| `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
-| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 
 ## Usage examples
 
@@ -369,9 +369,13 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
             }
           }
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         roleAssignments: [
           {
             principalId: '<principalId>'
@@ -392,9 +396,13 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -625,9 +633,13 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
               }
             }
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "roleAssignments": [
             {
               "principalId": "<principalId>",
@@ -648,9 +660,13 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -914,9 +930,13 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'vault'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -1028,9 +1048,13 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "vault",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -1936,8 +1960,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2121,19 +2144,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -2593,6 +2661,7 @@ Resource tags.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the key vault. |
+| `privateEndpoints` | array | The private endpoints of the key vault. |
 | `resourceGroupName` | string | The name of the resource group the key vault was created in. |
 | `resourceId` | string | The resource ID of the key vault. |
 | `uri` | string | The URI of the key vault. |
@@ -2603,7 +2672,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.4.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/key-vault/vault/main.bicep b/avm/res/key-vault/vault/main.bicep
index 3ae40ee117..b804b867e7 100644
--- a/avm/res/key-vault/vault/main.bicep
+++ b/avm/res/key-vault/vault/main.bicep
@@ -270,9 +270,9 @@ module keyVault_secrets 'secret/main.bicep' = [
       name: secret.name
       value: secret.value
       keyVaultName: keyVault.name
-      attributesEnabled: secret.?attributesEnabled
-      attributesExp: secret.?attributesExp
-      attributesNbf: secret.?attributesNbf
+      attributesEnabled: secret.?attributes.?enabled
+      attributesExp: secret.?attributes.?exp
+      attributesNbf: secret.?attributes.?nbf
       contentType: secret.?contentType
       tags: secret.?tags ?? tags
       roleAssignments: secret.?roleAssignments
@@ -286,9 +286,9 @@ module keyVault_keys 'key/main.bicep' = [
     params: {
       name: key.name
       keyVaultName: keyVault.name
-      attributesEnabled: key.?attributesEnabled
-      attributesExp: key.?attributesExp
-      attributesNbf: key.?attributesNbf
+      attributesEnabled: key.?attributes.?enabled
+      attributesExp: key.?attributes.?exp
+      attributesNbf: key.?attributes.?nbf
       curveName: (key.?kty != 'RSA' && key.?kty != 'RSA-HSM') ? (key.?curveName ?? 'P-256') : null
       keyOps: key.?keyOps
       keySize: (key.?kty == 'RSA' || key.?kty == 'RSA-HSM') ? (key.?keySize ?? 4096) : null
@@ -301,7 +301,7 @@ module keyVault_keys 'key/main.bicep' = [
   }
 ]
 
-module keyVault_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4.1' = [
+module keyVault_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-keyVault-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -342,8 +342,7 @@ module keyVault_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -388,6 +387,17 @@ output uri string = keyVault.properties.vaultUri
 @description('The location the resource was deployed into.')
 output location string = keyVault.location
 
+@description('The private endpoints of the key vault.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: keyVault_privateEndpoints[i].outputs.name
+    resourceId: keyVault_privateEndpoints[i].outputs.resourceId
+    groupId: keyVault_privateEndpoints[i].outputs.groupId
+    customDnsConfig: keyVault_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: keyVault_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // ================ //
 // Definitions      //
 // ================ //
@@ -478,11 +488,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
+
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/key-vault/vault/main.json b/avm/res/key-vault/vault/main.json
index 770f5100f3..15f25dc8bb 100644
--- a/avm/res/key-vault/vault/main.json
+++ b/avm/res/key-vault/vault/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "17375579299346578014"
+      "templateHash": "535497364453680203"
     },
     "name": "Key Vaults",
     "description": "This module deploys a Key Vault.",
@@ -245,21 +245,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -1445,13 +1468,13 @@
             "value": "[parameters('name')]"
           },
           "attributesEnabled": {
-            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesEnabled')]"
+            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'enabled')]"
           },
           "attributesExp": {
-            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesExp')]"
+            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'exp')]"
           },
           "attributesNbf": {
-            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributesNbf')]"
+            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'nbf')]"
           },
           "contentType": {
             "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]"
@@ -1732,13 +1755,13 @@
             "value": "[parameters('name')]"
           },
           "attributesEnabled": {
-            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesEnabled')]"
+            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'enabled')]"
           },
           "attributesExp": {
-            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesExp')]"
+            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'exp')]"
           },
           "attributesNbf": {
-            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributesNbf')]"
+            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'nbf')]"
           },
           "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]",
           "keyOps": {
@@ -2096,11 +2119,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -2128,19 +2148,47 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.25.53.49325",
-              "templateHash": "4120048060064073955"
+              "version": "0.29.47.4906",
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
                 "type": "object",
                 "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
                   "roleDefinitionIdOrName": {
                     "type": "string",
                     "metadata": {
@@ -2244,13 +2292,13 @@
                       "groupId": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "memberName": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "privateIPAddress": {
@@ -2284,8 +2332,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -2325,8 +2376,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -2374,6 +2428,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2409,18 +2486,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2476,6 +2546,13 @@
             }
           },
           "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
             "builtInRoleNames": {
               "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
               "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
@@ -2493,8 +2570,8 @@
             "avmTelemetry": {
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2023-07-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2512,7 +2589,7 @@
             },
             "privateEndpoint": {
               "type": "Microsoft.Network/privateEndpoints",
-              "apiVersion": "2023-04-01",
+              "apiVersion": "2023-11-01",
               "name": "[parameters('name')]",
               "location": "[parameters('location')]",
               "tags": "[parameters('tags')]",
@@ -2553,27 +2630,27 @@
             "privateEndpoint_roleAssignments": {
               "copy": {
                 "name": "privateEndpoint_roleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
               },
               "type": "Microsoft.Authorization/roleAssignments",
               "apiVersion": "2022-04-01",
               "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
               "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
               },
               "dependsOn": [
                 "privateEndpoint"
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2584,28 +2661,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "11244630631275470040"
+                      "version": "0.29.47.4906",
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2613,12 +2714,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2632,27 +2736,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                      "apiVersion": "2023-04-01",
+                      "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2710,14 +2823,28 @@
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+              "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+            },
+            "customDnsConfig": {
+              "$ref": "#/definitions/customDnsConfigType",
+              "metadata": {
+                "description": "The custom DNS configurations of the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').customDnsConfigs]"
+            },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
             },
             "groupId": {
               "type": "string",
               "metadata": {
                 "description": "The group Id for the private endpoint Group."
               },
-              "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+              "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
             }
           }
         }
@@ -2762,6 +2889,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('keyVault', '2022-07-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the key vault."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/key-vault/vault/tests/e2e/max/dependencies.bicep b/avm/res/key-vault/vault/tests/e2e/max/dependencies.bicep
index f433490224..6c3754d07f 100644
--- a/avm/res/key-vault/vault/tests/e2e/max/dependencies.bicep
+++ b/avm/res/key-vault/vault/tests/e2e/max/dependencies.bicep
@@ -62,4 +62,4 @@ output subnetResourceId string = virtualNetwork.properties.subnets[0].id
 output managedIdentityPrincipalId string = managedIdentity.properties.principalId
 
 @description('The resource ID of the created Private DNS Zone.')
-output privateDNSResourceId string = privateDNSZone.id
+output privateDNSZoneResourceId string = privateDNSZone.id
diff --git a/avm/res/key-vault/vault/tests/e2e/max/main.test.bicep b/avm/res/key-vault/vault/tests/e2e/max/main.test.bicep
index 9aa9d3e7b1..08693fdd86 100644
--- a/avm/res/key-vault/vault/tests/e2e/max/main.test.bicep
+++ b/avm/res/key-vault/vault/tests/e2e/max/main.test.bicep
@@ -192,9 +192,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -236,9 +240,13 @@ module testDeployment '../../../main.bicep' = [
           ]
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/key-vault/vault/tests/e2e/waf-aligned/dependencies.bicep b/avm/res/key-vault/vault/tests/e2e/waf-aligned/dependencies.bicep
index f433490224..6c3754d07f 100644
--- a/avm/res/key-vault/vault/tests/e2e/waf-aligned/dependencies.bicep
+++ b/avm/res/key-vault/vault/tests/e2e/waf-aligned/dependencies.bicep
@@ -62,4 +62,4 @@ output subnetResourceId string = virtualNetwork.properties.subnets[0].id
 output managedIdentityPrincipalId string = managedIdentity.properties.principalId
 
 @description('The resource ID of the created Private DNS Zone.')
-output privateDNSResourceId string = privateDNSZone.id
+output privateDNSZoneResourceId string = privateDNSZone.id
diff --git a/avm/res/key-vault/vault/tests/e2e/waf-aligned/main.test.bicep b/avm/res/key-vault/vault/tests/e2e/waf-aligned/main.test.bicep
index f75788795d..88763ac590 100644
--- a/avm/res/key-vault/vault/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/key-vault/vault/tests/e2e/waf-aligned/main.test.bicep
@@ -122,9 +122,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'vault'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
diff --git a/avm/res/key-vault/vault/version.json b/avm/res/key-vault/vault/version.json
index 7e1d3f4157..0f81d22abc 100644
--- a/avm/res/key-vault/vault/version.json
+++ b/avm/res/key-vault/vault/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.7",
+    "version": "0.8",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/kusto/cluster/README.md b/avm/res/kusto/cluster/README.md
index b7c5c1764d..dacf69d409 100644
--- a/avm/res/kusto/cluster/README.md
+++ b/avm/res/kusto/cluster/README.md
@@ -20,8 +20,8 @@ This module deploys a Kusto Cluster.
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
 | `Microsoft.Kusto/clusters` | [2023-08-15](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Kusto/2023-08-15/clusters) |
 | `Microsoft.Kusto/clusters/principalAssignments` | [2023-08-15](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Kusto/2023-08-15/clusters/principalAssignments) |
-| `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
-| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 
 ## Usage examples
 
@@ -33,7 +33,8 @@ The following section provides usage examples for the module, which were used to
 
 - [Using only defaults](#example-1-using-only-defaults)
 - [Using large parameter set](#example-2-using-large-parameter-set)
-- [WAF-aligned](#example-3-waf-aligned)
+- [Private endpoint-enabled deployment](#example-3-private-endpoint-enabled-deployment)
+- [WAF-aligned](#example-4-waf-aligned)
 
 ### Example 1: _Using only defaults_
 
@@ -301,7 +302,129 @@ module cluster 'br/public:avm/res/kusto/cluster:<version>' = {
 </details>
 <p>
 
-### Example 3: _WAF-aligned_
+### Example 3: _Private endpoint-enabled deployment_
+
+This instance deploys the module with private endpoints.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module cluster 'br/public:avm/res/kusto/cluster:<version>' = {
+  name: 'clusterDeployment'
+  params: {
+    // Required parameters
+    name: 'akcpe0001'
+    sku: 'Standard_E2ads_v5'
+    // Non-required parameters
+    enablePublicNetworkAccess: false
+    location: '<location>'
+    privateEndpoints: [
+      {
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
+        service: 'cluster'
+        subnetResourceId: '<subnetResourceId>'
+      }
+      {
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
+        service: 'cluster'
+        subnetResourceId: '<subnetResourceId>'
+      }
+    ]
+    publicIPType: 'IPv4'
+    tags: {
+      Environment: 'Non-Prod'
+      'hidden-title': 'This is visible in the resource name'
+      Role: 'DeploymentValidation'
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "name": {
+      "value": "akcpe0001"
+    },
+    "sku": {
+      "value": "Standard_E2ads_v5"
+    },
+    // Non-required parameters
+    "enablePublicNetworkAccess": {
+      "value": false
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "privateEndpoints": {
+      "value": [
+        {
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
+          "service": "cluster",
+          "subnetResourceId": "<subnetResourceId>"
+        },
+        {
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
+          "service": "cluster",
+          "subnetResourceId": "<subnetResourceId>"
+        }
+      ]
+    },
+    "publicIPType": {
+      "value": "IPv4"
+    },
+    "tags": {
+      "value": {
+        "Environment": "Non-Prod",
+        "hidden-title": "This is visible in the resource name",
+        "Role": "DeploymentValidation"
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 4: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
@@ -973,7 +1096,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`service`](#parameter-privateendpointsservice) | string | The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob". |
+| [`service`](#parameter-privateendpointsservice) | string | The subresource to deploy the private endpoint for. For example "blob", "table", "queue" or "file". |
 | [`subnetResourceId`](#parameter-privateendpointssubnetresourceid) | string | Resource ID of the subnet where the endpoint needs to be created. |
 
 **Optional parameters**
@@ -985,19 +1108,20 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`customNetworkInterfaceName`](#parameter-privateendpointscustomnetworkinterfacename) | string | The custom name of the network interface attached to the private endpoint. |
 | [`enableTelemetry`](#parameter-privateendpointsenabletelemetry) | bool | Enable/Disable usage telemetry for module. |
 | [`ipConfigurations`](#parameter-privateendpointsipconfigurations) | array | A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints. |
-| [`isManualConnection`](#parameter-privateendpointsismanualconnection) | bool | Manual PrivateLink Service Connections. |
+| [`isManualConnection`](#parameter-privateendpointsismanualconnection) | bool | If Manual Private Link Connection is required. |
 | [`location`](#parameter-privateendpointslocation) | string | The location to deploy the private endpoint to. |
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
+| [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
+| [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
 | [`tags`](#parameter-privateendpointstags) | object | Tags to be applied on all resources/resource groups in this deployment. |
 
 ### Parameter: `privateEndpoints.service`
 
-The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob".
+The subresource to deploy the private endpoint for. For example "blob", "table", "queue" or "file".
 
 - Required: Yes
 - Type: string
@@ -1027,19 +1151,19 @@ Custom DNS configurations.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`fqdn`](#parameter-privateendpointscustomdnsconfigsfqdn) | string | Fqdn that resolves to private endpoint ip address. |
-| [`ipAddresses`](#parameter-privateendpointscustomdnsconfigsipaddresses) | array | A list of private ip addresses of the private endpoint. |
+| [`fqdn`](#parameter-privateendpointscustomdnsconfigsfqdn) | string | Fqdn that resolves to private endpoint IP address. |
+| [`ipAddresses`](#parameter-privateendpointscustomdnsconfigsipaddresses) | array | A list of private IP addresses of the private endpoint. |
 
 ### Parameter: `privateEndpoints.customDnsConfigs.fqdn`
 
-Fqdn that resolves to private endpoint ip address.
+Fqdn that resolves to private endpoint IP address.
 
 - Required: No
 - Type: string
 
 ### Parameter: `privateEndpoints.customDnsConfigs.ipAddresses`
 
-A list of private ip addresses of the private endpoint.
+A list of private IP addresses of the private endpoint.
 
 - Required: Yes
 - Type: array
@@ -1092,7 +1216,7 @@ Properties of private endpoint IP configurations.
 | :-- | :-- | :-- |
 | [`groupId`](#parameter-privateendpointsipconfigurationspropertiesgroupid) | string | The ID of a group obtained from the remote resource that this private endpoint should connect to. |
 | [`memberName`](#parameter-privateendpointsipconfigurationspropertiesmembername) | string | The member name of a group obtained from the remote resource that this private endpoint should connect to. |
-| [`privateIPAddress`](#parameter-privateendpointsipconfigurationspropertiesprivateipaddress) | string | A private ip address obtained from the private endpoint's subnet. |
+| [`privateIPAddress`](#parameter-privateendpointsipconfigurationspropertiesprivateipaddress) | string | A private IP address obtained from the private endpoint's subnet. |
 
 ### Parameter: `privateEndpoints.ipConfigurations.properties.groupId`
 
@@ -1110,14 +1234,14 @@ The member name of a group obtained from the remote resource that this private e
 
 ### Parameter: `privateEndpoints.ipConfigurations.properties.privateIPAddress`
 
-A private ip address obtained from the private endpoint's subnet.
+A private IP address obtained from the private endpoint's subnet.
 
 - Required: Yes
 - Type: string
 
 ### Parameter: `privateEndpoints.isManualConnection`
 
-Manual PrivateLink Service Connections.
+If Manual Private Link Connection is required.
 
 - Required: No
 - Type: bool
@@ -1179,19 +1303,78 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
+
+### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
+
+The name of the private link connection to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `privateEndpoints.resourceGroupName`
+
+Specify if you want to deploy the Private Endpoint into a different resource group than the main resource.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.roleAssignments`
 
@@ -1509,9 +1692,10 @@ The resource ID of the subnet to which to deploy the Kusto Cluster.
 | Output | Type | Description |
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
-| `name` | string | The name of the resource. |
-| `resourceGroupName` | string | The resource group the resource was deployed into. |
-| `resourceId` | string | The resource id of the resource. |
+| `name` | string | The name of the kusto cluster. |
+| `privateEndpoints` | array | The private endpoints of the kusto cluster. |
+| `resourceGroupName` | string | The resource group the kusto cluster was deployed into. |
+| `resourceId` | string | The resource id of the kusto cluster. |
 
 ## Cross-referenced modules
 
@@ -1519,7 +1703,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.4.0` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/kusto/cluster/main.bicep b/avm/res/kusto/cluster/main.bicep
index 345e2b7317..2a9802eb5e 100644
--- a/avm/res/kusto/cluster/main.bicep
+++ b/avm/res/kusto/cluster/main.bicep
@@ -301,12 +301,14 @@ module kustoCluster_principalAssignments 'principal-assignment/main.bicep' = [
   }
 ]
 
-module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4.0' = [
+@batchSize(1)
+module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-KustoCluster-PrivateEndpoint-${index}'
+    name: '${uniqueString(deployment().name, location)}-kustoCluster-PrivateEndpoint-${index}'
+    scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
     params: {
       name: privateEndpoint.?name ?? 'pep-${last(split(kustoCluster.id, '/'))}-${privateEndpoint.service}-${index}'
-      privateLinkServiceConnections: privateEndpoint.?manualPrivateLinkServiceConnections != true
+      privateLinkServiceConnections: privateEndpoint.?isManualConnection != true
         ? [
             {
               name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(kustoCluster.id, '/'))}-${privateEndpoint.service}-${index}'
@@ -319,7 +321,7 @@ module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint
             }
           ]
         : null
-      manualPrivateLinkServiceConnections: privateEndpoint.?manualPrivateLinkServiceConnections == true
+      manualPrivateLinkServiceConnections: privateEndpoint.?isManualConnection == true
         ? [
             {
               name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(kustoCluster.id, '/'))}-${privateEndpoint.service}-${index}'
@@ -341,8 +343,7 @@ module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -357,18 +358,29 @@ module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint
 // Outputs      //
 // ============ //
 
-@description('The resource group the resource was deployed into.')
+@description('The resource group the kusto cluster was deployed into.')
 output resourceGroupName string = resourceGroup().name
 
-@description('The resource id of the resource.')
+@description('The resource id of the kusto cluster.')
 output resourceId string = kustoCluster.id
 
-@description('The name of the resource.')
+@description('The name of the kusto cluster.')
 output name string = kustoCluster.name
 
 @description('The location the resource was deployed into.')
 output location string = kustoCluster.location
 
+@description('The private endpoints of the kusto cluster.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: kustoCluster_privateEndpoints[i].outputs.name
+    resourceId: kustoCluster_privateEndpoints[i].outputs.resourceId
+    groupId: kustoCluster_privateEndpoints[i].outputs.groupId
+    customDnsConfig: kustoCluster_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: kustoCluster_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -478,19 +490,31 @@ type privateEndpointType = {
   @description('Optional. The location to deploy the private endpoint to.')
   location: string?
 
-  @description('Required. The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob".')
+  @description('Optional. The name of the private link connection to create.')
+  privateLinkServiceConnectionName: string?
+
+  @description('Required. The subresource to deploy the private endpoint for. For example "blob", "table", "queue" or "file".')
   service: string
 
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
-  @description('Optional. Manual PrivateLink Service Connections.')
+  @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
 
   @description('Optional. A message passed to the owner of the remote resource with the manual connection request.')
@@ -499,10 +523,10 @@ type privateEndpointType = {
 
   @description('Optional. Custom DNS configurations.')
   customDnsConfigs: {
-    @description('Required. Fqdn that resolves to private endpoint ip address.')
+    @description('Required. Fqdn that resolves to private endpoint IP address.')
     fqdn: string?
 
-    @description('Required. A list of private ip addresses of the private endpoint.')
+    @description('Required. A list of private IP addresses of the private endpoint.')
     ipAddresses: string[]
   }[]?
 
@@ -519,7 +543,7 @@ type privateEndpointType = {
       @description('Required. The member name of a group obtained from the remote resource that this private endpoint should connect to.')
       memberName: string
 
-      @description('Required. A private ip address obtained from the private endpoint\'s subnet.')
+      @description('Required. A private IP address obtained from the private endpoint\'s subnet.')
       privateIPAddress: string
     }
   }[]?
@@ -541,6 +565,9 @@ type privateEndpointType = {
 
   @description('Optional. Enable/Disable usage telemetry for module.')
   enableTelemetry: bool?
+
+  @description('Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource.')
+  resourceGroupName: string?
 }[]?
 
 type roleAssignmentType = {
diff --git a/avm/res/kusto/cluster/main.json b/avm/res/kusto/cluster/main.json
index 21f5cc3e7e..8135431606 100644
--- a/avm/res/kusto/cluster/main.json
+++ b/avm/res/kusto/cluster/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "5568505662059755727"
+      "templateHash": "4366309935211132094"
     },
     "name": "Kusto Cluster",
     "description": "This module deploys a Kusto Cluster.",
@@ -283,40 +283,70 @@
               "description": "Optional. The location to deploy the private endpoint to."
             }
           },
-          "service": {
+          "privateLinkServiceConnectionName": {
             "type": "string",
+            "nullable": true,
             "metadata": {
-              "description": "Required. The service (sub-) type to deploy the private endpoint for. For example \"vault\" or \"blob\"."
+              "description": "Optional. The name of the private link connection to create."
             }
           },
-          "subnetResourceId": {
+          "service": {
             "type": "string",
             "metadata": {
-              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+              "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\"."
             }
           },
-          "privateDnsZoneGroupName": {
+          "subnetResourceId": {
             "type": "string",
-            "nullable": true,
             "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided."
+              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
             "type": "bool",
             "nullable": true,
             "metadata": {
-              "description": "Optional. Manual PrivateLink Service Connections."
+              "description": "Optional. If Manual Private Link Connection is required."
             }
           },
           "manualConnectionRequestMessage": {
@@ -336,7 +366,7 @@
                   "type": "string",
                   "nullable": true,
                   "metadata": {
-                    "description": "Required. Fqdn that resolves to private endpoint ip address."
+                    "description": "Required. Fqdn that resolves to private endpoint IP address."
                   }
                 },
                 "ipAddresses": {
@@ -345,7 +375,7 @@
                     "type": "string"
                   },
                   "metadata": {
-                    "description": "Required. A list of private ip addresses of the private endpoint."
+                    "description": "Required. A list of private IP addresses of the private endpoint."
                   }
                 }
               }
@@ -384,7 +414,7 @@
                     "privateIPAddress": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. A private ip address obtained from the private endpoint's subnet."
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
                       }
                     }
                   },
@@ -441,6 +471,13 @@
             "metadata": {
               "description": "Optional. Enable/Disable usage telemetry for module."
             }
+          },
+          "resourceGroupName": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
+            }
           }
         }
       },
@@ -1129,11 +1166,14 @@
     "kustoCluster_privateEndpoints": {
       "copy": {
         "name": "kustoCluster_privateEndpoints",
-        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+        "mode": "serial",
+        "batchSize": 1
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-KustoCluster-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "name": "[format('{0}-kustoCluster-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
@@ -1143,8 +1183,8 @@
           "name": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Kusto/clusters', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
           },
-          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualPrivateLinkServiceConnections'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Kusto/clusters', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Kusto/clusters', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualPrivateLinkServiceConnections'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Kusto/clusters', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Kusto/clusters', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Kusto/clusters', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Kusto/clusters', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Kusto/clusters', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Kusto/clusters', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
           "subnetResourceId": {
             "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
           },
@@ -1157,11 +1197,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1189,19 +1226,47 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.24.24.22086",
-              "templateHash": "2592884001616184297"
+              "version": "0.29.47.4906",
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
                 "type": "object",
                 "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
                   "roleDefinitionIdOrName": {
                     "type": "string",
                     "metadata": {
@@ -1305,13 +1370,13 @@
                       "groupId": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "memberName": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "privateIPAddress": {
@@ -1345,8 +1410,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -1386,8 +1454,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -1435,6 +1506,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1470,18 +1564,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1537,6 +1624,13 @@
             }
           },
           "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
             "builtInRoleNames": {
               "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
               "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
@@ -1554,8 +1648,8 @@
             "avmTelemetry": {
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2023-07-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1573,7 +1667,7 @@
             },
             "privateEndpoint": {
               "type": "Microsoft.Network/privateEndpoints",
-              "apiVersion": "2023-04-01",
+              "apiVersion": "2023-11-01",
               "name": "[parameters('name')]",
               "location": "[parameters('location')]",
               "tags": "[parameters('tags')]",
@@ -1614,27 +1708,27 @@
             "privateEndpoint_roleAssignments": {
               "copy": {
                 "name": "privateEndpoint_roleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
               },
               "type": "Microsoft.Authorization/roleAssignments",
               "apiVersion": "2022-04-01",
               "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
               "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
               },
               "dependsOn": [
                 "privateEndpoint"
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1645,28 +1739,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.24.24.22086",
-                      "templateHash": "9321937464667207030"
+                      "version": "0.29.47.4906",
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1674,12 +1792,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1693,27 +1814,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                      "apiVersion": "2023-04-01",
+                      "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1771,14 +1901,28 @@
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+              "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+            },
+            "customDnsConfig": {
+              "$ref": "#/definitions/customDnsConfigType",
+              "metadata": {
+                "description": "The custom DNS configurations of the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').customDnsConfigs]"
+            },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
             },
             "groupId": {
               "type": "string",
               "metadata": {
                 "description": "The group Id for the private endpoint Group."
               },
-              "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+              "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
             }
           }
         }
@@ -1792,21 +1936,21 @@
     "resourceGroupName": {
       "type": "string",
       "metadata": {
-        "description": "The resource group the resource was deployed into."
+        "description": "The resource group the kusto cluster was deployed into."
       },
       "value": "[resourceGroup().name]"
     },
     "resourceId": {
       "type": "string",
       "metadata": {
-        "description": "The resource id of the resource."
+        "description": "The resource id of the kusto cluster."
       },
       "value": "[resourceId('Microsoft.Kusto/clusters', parameters('name'))]"
     },
     "name": {
       "type": "string",
       "metadata": {
-        "description": "The name of the resource."
+        "description": "The name of the kusto cluster."
       },
       "value": "[parameters('name')]"
     },
@@ -1816,6 +1960,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('kustoCluster', '2023-08-15', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the kusto cluster."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('kustoCluster_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('kustoCluster_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('kustoCluster_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('kustoCluster_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('kustoCluster_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/kusto/cluster/tests/e2e/pe/dependencies.bicep b/avm/res/kusto/cluster/tests/e2e/pe/dependencies.bicep
new file mode 100644
index 0000000000..1b34a4ac45
--- /dev/null
+++ b/avm/res/kusto/cluster/tests/e2e/pe/dependencies.bicep
@@ -0,0 +1,68 @@
+@description('Optional. The location to deploy to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+var addressPrefix = '10.0.0.0/16'
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 24, 0)
+          serviceEndpoints: [
+            {
+              service: 'Microsoft.KeyVault'
+            }
+          ]
+        }
+      }
+      {
+        name: 'peTestSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 24, 1)
+          serviceEndpoints: [
+            {
+              service: 'Microsoft.KeyVault'
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
+
+resource privateDNSZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
+  name: 'privatelink.digitaltwins.azure.net'
+  location: 'global'
+
+  resource virtualNetworkLinks 'virtualNetworkLinks@2020-06-01' = {
+    name: '${virtualNetwork.name}-vnetlink'
+    location: 'global'
+    properties: {
+      virtualNetwork: {
+        id: virtualNetwork.id
+      }
+      registrationEnabled: false
+    }
+  }
+}
+
+@description('The resource ID of the created Virtual Network Subnet.')
+output defaultSubnetResourceId string = virtualNetwork.properties.subnets[0].id
+
+@description('The resource ID of the created Virtual Network Subnet.')
+output pepTestSubnetResourceId string = virtualNetwork.properties.subnets[1].id
+
+@description('The resource ID of the created Private DNS Zone.')
+output privateDNSZoneResourceId string = privateDNSZone.id
diff --git a/avm/res/kusto/cluster/tests/e2e/pe/main.test.bicep b/avm/res/kusto/cluster/tests/e2e/pe/main.test.bicep
new file mode 100644
index 0000000000..bdb035d2c8
--- /dev/null
+++ b/avm/res/kusto/cluster/tests/e2e/pe/main.test.bicep
@@ -0,0 +1,92 @@
+targetScope = 'subscription'
+
+metadata name = 'Private endpoint-enabled deployment'
+metadata description = 'This instance deploys the module with private endpoints.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-kusto.clusters-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'akcpe'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    location: resourceLocation
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}0001'
+      location: resourceLocation
+      sku: 'Standard_E2ads_v5'
+      enablePublicNetworkAccess: false
+      publicIPType: 'IPv4'
+      privateEndpoints: [
+        {
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
+          subnetResourceId: nestedDependencies.outputs.defaultSubnetResourceId
+          service: 'cluster'
+        }
+        {
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
+          subnetResourceId: nestedDependencies.outputs.pepTestSubnetResourceId
+          service: 'cluster'
+        }
+      ]
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
+      }
+    }
+    dependsOn: [
+      nestedDependencies
+    ]
+  }
+]
diff --git a/avm/res/kusto/cluster/version.json b/avm/res/kusto/cluster/version.json
index 729ac87673..76049e1c4a 100644
--- a/avm/res/kusto/cluster/version.json
+++ b/avm/res/kusto/cluster/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.2",
+  "version": "0.3",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/res/machine-learning-services/workspace/README.md b/avm/res/machine-learning-services/workspace/README.md
index 04114ecba1..860f066e50 100644
--- a/avm/res/machine-learning-services/workspace/README.md
+++ b/avm/res/machine-learning-services/workspace/README.md
@@ -21,6 +21,7 @@ This module deploys a Machine Learning Services Workspace.
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
 | `Microsoft.MachineLearningServices/workspaces` | [2024-04-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.MachineLearningServices/2024-04-01-preview/workspaces) |
 | `Microsoft.MachineLearningServices/workspaces/computes` | [2022-10-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.MachineLearningServices/2022-10-01/workspaces/computes) |
+| `Microsoft.MachineLearningServices/workspaces/connections` | [2024-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.MachineLearningServices/2024-04-01/workspaces/connections) |
 | `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
 | `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 
@@ -59,6 +60,26 @@ module workspace 'br/public:avm/res/machine-learning-services/workspace:<version
     associatedApplicationInsightsResourceId: '<associatedApplicationInsightsResourceId>'
     associatedKeyVaultResourceId: '<associatedKeyVaultResourceId>'
     associatedStorageAccountResourceId: '<associatedStorageAccountResourceId>'
+    connections: [
+      {
+        category: 'AIServices'
+        connectionProperties: {
+          authType: 'ApiKey'
+          credentials: {
+            key: 'key'
+          }
+        }
+        metadata: {
+          ApiType: 'Azure'
+          ApiVersion: '2023-07-01-preview'
+          DeploymentApiVersion: '2023-10-01-preview'
+          Location: '<Location>'
+          ResourceId: '<ResourceId>'
+        }
+        name: 'ai'
+        target: '<target>'
+      }
+    ]
     kind: 'Hub'
     location: '<location>'
     workspaceHubConfig: {
@@ -98,6 +119,28 @@ module workspace 'br/public:avm/res/machine-learning-services/workspace:<version
     "associatedStorageAccountResourceId": {
       "value": "<associatedStorageAccountResourceId>"
     },
+    "connections": {
+      "value": [
+        {
+          "category": "AIServices",
+          "connectionProperties": {
+            "authType": "ApiKey",
+            "credentials": {
+              "key": "key"
+            }
+          },
+          "metadata": {
+            "ApiType": "Azure",
+            "ApiVersion": "2023-07-01-preview",
+            "DeploymentApiVersion": "2023-10-01-preview",
+            "Location": "<Location>",
+            "ResourceId": "<ResourceId>"
+          },
+          "name": "ai",
+          "target": "<target>"
+        }
+      ]
+    },
     "kind": {
       "value": "Hub"
     },
@@ -433,6 +476,19 @@ module workspace 'br/public:avm/res/machine-learning-services/workspace:<version
         sku: 'Basic'
       }
     ]
+    connections: [
+      {
+        category: 'ApiKey'
+        connectionProperties: {
+          authType: 'ApiKey'
+          credentials: {
+            key: 'key'
+          }
+        }
+        name: 'connection'
+        target: 'https://example.com'
+      }
+    ]
     description: 'The cake is a lie.'
     diagnosticSettings: [
       {
@@ -591,6 +647,21 @@ module workspace 'br/public:avm/res/machine-learning-services/workspace:<version
         }
       ]
     },
+    "connections": {
+      "value": [
+        {
+          "category": "ApiKey",
+          "connectionProperties": {
+            "authType": "ApiKey",
+            "credentials": {
+              "key": "key"
+            }
+          },
+          "name": "connection",
+          "target": "https://example.com"
+        }
+      ]
+    },
     "description": {
       "value": "The cake is a lie."
     },
@@ -939,6 +1010,7 @@ module workspace 'br/public:avm/res/machine-learning-services/workspace:<version
 | :-- | :-- | :-- |
 | [`associatedContainerRegistryResourceId`](#parameter-associatedcontainerregistryresourceid) | string | The resource ID of the associated Container Registry. |
 | [`computes`](#parameter-computes) | array | Computes to create respectively attach to the workspace. |
+| [`connections`](#parameter-connections) | array | Connections to create in the workspace. |
 | [`customerManagedKey`](#parameter-customermanagedkey) | object | The customer managed key definition. |
 | [`description`](#parameter-description) | string | The description of this workspace. |
 | [`diagnosticSettings`](#parameter-diagnosticsettings) | array | The diagnostic settings of the service. |
@@ -1082,6 +1154,216 @@ Computes to create respectively attach to the workspace.
 - Required: No
 - Type: array
 
+### Parameter: `connections`
+
+Connections to create in the workspace.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`category`](#parameter-connectionscategory) | string | Category of the connection. |
+| [`connectionProperties`](#parameter-connectionsconnectionproperties) | secureObject | The properties of the connection, specific to the auth type. |
+| [`name`](#parameter-connectionsname) | string | Name of the connection to create. |
+| [`target`](#parameter-connectionstarget) | string | The target of the connection. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`expiryTime`](#parameter-connectionsexpirytime) | string | The expiry time of the connection. |
+| [`isSharedToAll`](#parameter-connectionsissharedtoall) | bool | Indicates whether the connection is shared to all users in the workspace. |
+| [`metadata`](#parameter-connectionsmetadata) | object | User metadata for the connection. |
+| [`sharedUserList`](#parameter-connectionsshareduserlist) | array | The shared user list of the connection. |
+| [`value`](#parameter-connectionsvalue) | string | Value details of the workspace connection. |
+
+### Parameter: `connections.category`
+
+Category of the connection.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'ADLSGen2'
+    'AIServices'
+    'AmazonMws'
+    'AmazonRdsForOracle'
+    'AmazonRdsForSqlServer'
+    'AmazonRedshift'
+    'AmazonS3Compatible'
+    'ApiKey'
+    'AzureBlob'
+    'AzureDatabricksDeltaLake'
+    'AzureDataExplorer'
+    'AzureMariaDb'
+    'AzureMySqlDb'
+    'AzureOneLake'
+    'AzureOpenAI'
+    'AzurePostgresDb'
+    'AzureSqlDb'
+    'AzureSqlMi'
+    'AzureSynapseAnalytics'
+    'AzureTableStorage'
+    'BingLLMSearch'
+    'Cassandra'
+    'CognitiveSearch'
+    'CognitiveService'
+    'Concur'
+    'ContainerRegistry'
+    'CosmosDb'
+    'CosmosDbMongoDbApi'
+    'Couchbase'
+    'CustomKeys'
+    'Db2'
+    'Drill'
+    'Dynamics'
+    'DynamicsAx'
+    'DynamicsCrm'
+    'Eloqua'
+    'FileServer'
+    'FtpServer'
+    'GenericContainerRegistry'
+    'GenericHttp'
+    'GenericRest'
+    'Git'
+    'GoogleAdWords'
+    'GoogleBigQuery'
+    'GoogleCloudStorage'
+    'Greenplum'
+    'Hbase'
+    'Hdfs'
+    'Hive'
+    'Hubspot'
+    'Impala'
+    'Informix'
+    'Jira'
+    'Magento'
+    'MariaDb'
+    'Marketo'
+    'MicrosoftAccess'
+    'MongoDbAtlas'
+    'MongoDbV2'
+    'MySql'
+    'Netezza'
+    'ODataRest'
+    'Odbc'
+    'Office365'
+    'OpenAI'
+    'Oracle'
+    'OracleCloudStorage'
+    'OracleServiceCloud'
+    'PayPal'
+    'Phoenix'
+    'PostgreSql'
+    'Presto'
+    'PythonFeed'
+    'QuickBooks'
+    'Redis'
+    'Responsys'
+    'S3'
+    'Salesforce'
+    'SalesforceMarketingCloud'
+    'SalesforceServiceCloud'
+    'SapBw'
+    'SapCloudForCustomer'
+    'SapEcc'
+    'SapHana'
+    'SapOpenHub'
+    'SapTable'
+    'Serp'
+    'Serverless'
+    'ServiceNow'
+    'Sftp'
+    'SharePointOnlineList'
+    'Shopify'
+    'Snowflake'
+    'Spark'
+    'SqlServer'
+    'Square'
+    'Sybase'
+    'Teradata'
+    'Vertica'
+    'WebTable'
+    'Xero'
+    'Zoho'
+  ]
+  ```
+
+### Parameter: `connections.connectionProperties`
+
+The properties of the connection, specific to the auth type.
+
+- Required: Yes
+- Type: secureObject
+
+### Parameter: `connections.name`
+
+Name of the connection to create.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `connections.target`
+
+The target of the connection.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `connections.expiryTime`
+
+The expiry time of the connection.
+
+- Required: No
+- Type: string
+
+### Parameter: `connections.isSharedToAll`
+
+Indicates whether the connection is shared to all users in the workspace.
+
+- Required: No
+- Type: bool
+
+### Parameter: `connections.metadata`
+
+User metadata for the connection.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`>Any_other_property<`](#parameter-connectionsmetadata>any_other_property<) | string | The metadata key-value pairs. |
+
+### Parameter: `connections.metadata.>Any_other_property<`
+
+The metadata key-value pairs.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `connections.sharedUserList`
+
+The shared user list of the connection.
+
+- Required: No
+- Type: array
+
+### Parameter: `connections.value`
+
+Value details of the workspace connection.
+
+- Required: No
+- Type: string
+
 ### Parameter: `customerManagedKey`
 
 The customer managed key definition.
diff --git a/avm/res/machine-learning-services/workspace/connection/README.md b/avm/res/machine-learning-services/workspace/connection/README.md
new file mode 100644
index 0000000000..c059ca8189
--- /dev/null
+++ b/avm/res/machine-learning-services/workspace/connection/README.md
@@ -0,0 +1,236 @@
+# Machine Learning Services Workspaces Connections `[Microsoft.MachineLearningServices/workspaces/connections]`
+
+This module creates a connection in a Machine Learning Services workspace.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.MachineLearningServices/workspaces/connections` | [2024-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.MachineLearningServices/2024-04-01/workspaces/connections) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`category`](#parameter-category) | string | Category of the connection. |
+| [`connectionProperties`](#parameter-connectionproperties) | secureObject | The properties of the connection, specific to the auth type. |
+| [`machineLearningWorkspaceName`](#parameter-machinelearningworkspacename) | string | The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment. |
+| [`name`](#parameter-name) | string | Name of the connection to create. |
+| [`target`](#parameter-target) | string | The target of the connection. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`expiryTime`](#parameter-expirytime) | string | The expiry time of the connection. |
+| [`isSharedToAll`](#parameter-issharedtoall) | bool | Indicates whether the connection is shared to all users in the workspace. |
+| [`metadata`](#parameter-metadata) | object | User metadata for the connection. |
+| [`sharedUserList`](#parameter-shareduserlist) | array | The shared user list of the connection. |
+| [`value`](#parameter-value) | string | Value details of the workspace connection. |
+
+### Parameter: `category`
+
+Category of the connection.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'ADLSGen2'
+    'AIServices'
+    'AmazonMws'
+    'AmazonRdsForOracle'
+    'AmazonRdsForSqlServer'
+    'AmazonRedshift'
+    'AmazonS3Compatible'
+    'ApiKey'
+    'AzureBlob'
+    'AzureDatabricksDeltaLake'
+    'AzureDataExplorer'
+    'AzureMariaDb'
+    'AzureMySqlDb'
+    'AzureOneLake'
+    'AzureOpenAI'
+    'AzurePostgresDb'
+    'AzureSqlDb'
+    'AzureSqlMi'
+    'AzureSynapseAnalytics'
+    'AzureTableStorage'
+    'BingLLMSearch'
+    'Cassandra'
+    'CognitiveSearch'
+    'CognitiveService'
+    'Concur'
+    'ContainerRegistry'
+    'CosmosDb'
+    'CosmosDbMongoDbApi'
+    'Couchbase'
+    'CustomKeys'
+    'Db2'
+    'Drill'
+    'Dynamics'
+    'DynamicsAx'
+    'DynamicsCrm'
+    'Eloqua'
+    'FileServer'
+    'FtpServer'
+    'GenericContainerRegistry'
+    'GenericHttp'
+    'GenericRest'
+    'Git'
+    'GoogleAdWords'
+    'GoogleBigQuery'
+    'GoogleCloudStorage'
+    'Greenplum'
+    'Hbase'
+    'Hdfs'
+    'Hive'
+    'Hubspot'
+    'Impala'
+    'Informix'
+    'Jira'
+    'Magento'
+    'MariaDb'
+    'Marketo'
+    'MicrosoftAccess'
+    'MongoDbAtlas'
+    'MongoDbV2'
+    'MySql'
+    'Netezza'
+    'ODataRest'
+    'Odbc'
+    'Office365'
+    'OpenAI'
+    'Oracle'
+    'OracleCloudStorage'
+    'OracleServiceCloud'
+    'PayPal'
+    'Phoenix'
+    'PostgreSql'
+    'Presto'
+    'PythonFeed'
+    'QuickBooks'
+    'Redis'
+    'Responsys'
+    'S3'
+    'Salesforce'
+    'SalesforceMarketingCloud'
+    'SalesforceServiceCloud'
+    'SapBw'
+    'SapCloudForCustomer'
+    'SapEcc'
+    'SapHana'
+    'SapOpenHub'
+    'SapTable'
+    'Serp'
+    'Serverless'
+    'ServiceNow'
+    'Sftp'
+    'SharePointOnlineList'
+    'Shopify'
+    'Snowflake'
+    'Spark'
+    'SqlServer'
+    'Square'
+    'Sybase'
+    'Teradata'
+    'Vertica'
+    'WebTable'
+    'Xero'
+    'Zoho'
+  ]
+  ```
+
+### Parameter: `connectionProperties`
+
+The properties of the connection, specific to the auth type.
+
+- Required: Yes
+- Type: secureObject
+
+### Parameter: `machineLearningWorkspaceName`
+
+The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `name`
+
+Name of the connection to create.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `target`
+
+The target of the connection.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `expiryTime`
+
+The expiry time of the connection.
+
+- Required: No
+- Type: string
+
+### Parameter: `isSharedToAll`
+
+Indicates whether the connection is shared to all users in the workspace.
+
+- Required: No
+- Type: bool
+
+### Parameter: `metadata`
+
+User metadata for the connection.
+
+- Required: No
+- Type: object
+- Default: `{}`
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`>Any_other_property<`](#parameter-metadata>any_other_property<) | string | The metadata key-value pairs. |
+
+### Parameter: `metadata.>Any_other_property<`
+
+The metadata key-value pairs.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `sharedUserList`
+
+The shared user list of the connection.
+
+- Required: No
+- Type: array
+
+### Parameter: `value`
+
+Value details of the workspace connection.
+
+- Required: No
+- Type: string
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the connection. |
+| `resourceGroupName` | string | The name of the resource group the connection was created in. |
+| `resourceId` | string | The resource ID of the connection. |
diff --git a/avm/res/machine-learning-services/workspace/connection/main.bicep b/avm/res/machine-learning-services/workspace/connection/main.bicep
new file mode 100644
index 0000000000..0aeab2a4f7
--- /dev/null
+++ b/avm/res/machine-learning-services/workspace/connection/main.bicep
@@ -0,0 +1,393 @@
+metadata name = 'Machine Learning Services Workspaces Connections'
+metadata description = 'This module creates a connection in a Machine Learning Services workspace.'
+metadata owner = 'Azure/module-maintainers'
+
+// ================ //
+// Parameters       //
+// ================ //
+
+@description('Required. Name of the connection to create.')
+param name string
+
+@description('Required. The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment.')
+param machineLearningWorkspaceName string
+
+@description('Required. Category of the connection.')
+param category categoryType
+
+@description('Optional. The expiry time of the connection.')
+param expiryTime string?
+
+@description('Optional. Indicates whether the connection is shared to all users in the workspace.')
+param isSharedToAll bool?
+
+@description('Optional. User metadata for the connection.')
+param metadata metadataType = {}
+
+@description('Optional. The shared user list of the connection.')
+param sharedUserList string[]?
+
+@description('Required. The target of the connection.')
+param target string
+
+@description('Optional. Value details of the workspace connection.')
+param value string?
+
+@description('Required. The properties of the connection, specific to the auth type.')
+param connectionProperties connectionPropertyType
+
+// ============================= //
+// Existing resources references //
+// ============================= //
+
+resource machineLearningWorkspace 'Microsoft.MachineLearningServices/workspaces@2022-10-01' existing = {
+  name: machineLearningWorkspaceName
+}
+
+// ============== //
+// Resources      //
+// ============== //
+
+resource connection 'Microsoft.MachineLearningServices/workspaces/connections@2024-04-01' = {
+  name: name
+  parent: machineLearningWorkspace
+  properties: union(
+    {
+      category: category
+      expiryTime: expiryTime
+      isSharedToAll: isSharedToAll
+      metadata: metadata
+      sharedUserList: sharedUserList
+      target: target
+      value: value
+    },
+    connectionProperties
+  )
+}
+
+// ============ //
+// Outputs      //
+// ============ //
+
+@description('The resource ID of the connection.')
+output resourceId string = connection.id
+
+@description('The name of the connection.')
+output name string = connection.name
+
+@description('The name of the resource group the connection was created in.')
+output resourceGroupName string = resourceGroup().name
+
+// ================ //
+// Definitions      //
+// ================ //
+
+type metadataType = {
+  @description('Required. The metadata key-value pairs.')
+  *: string
+}
+
+@export()
+type categoryType =
+  | 'ADLSGen2'
+  | 'AIServices'
+  | 'AmazonMws'
+  | 'AmazonRdsForOracle'
+  | 'AmazonRdsForSqlServer'
+  | 'AmazonRedshift'
+  | 'AmazonS3Compatible'
+  | 'ApiKey'
+  | 'AzureBlob'
+  | 'AzureDataExplorer'
+  | 'AzureDatabricksDeltaLake'
+  | 'AzureMariaDb'
+  | 'AzureMySqlDb'
+  | 'AzureOneLake'
+  | 'AzureOpenAI'
+  | 'AzurePostgresDb'
+  | 'AzureSqlDb'
+  | 'AzureSqlMi'
+  | 'AzureSynapseAnalytics'
+  | 'AzureTableStorage'
+  | 'BingLLMSearch'
+  | 'Cassandra'
+  | 'CognitiveSearch'
+  | 'CognitiveService'
+  | 'Concur'
+  | 'ContainerRegistry'
+  | 'CosmosDb'
+  | 'CosmosDbMongoDbApi'
+  | 'Couchbase'
+  | 'CustomKeys'
+  | 'Db2'
+  | 'Drill'
+  | 'Dynamics'
+  | 'DynamicsAx'
+  | 'DynamicsCrm'
+  | 'Eloqua'
+  | 'FileServer'
+  | 'FtpServer'
+  | 'GenericContainerRegistry'
+  | 'GenericHttp'
+  | 'GenericRest'
+  | 'Git'
+  | 'GoogleAdWords'
+  | 'GoogleBigQuery'
+  | 'GoogleCloudStorage'
+  | 'Greenplum'
+  | 'Hbase'
+  | 'Hdfs'
+  | 'Hive'
+  | 'Hubspot'
+  | 'Impala'
+  | 'Informix'
+  | 'Jira'
+  | 'Magento'
+  | 'MariaDb'
+  | 'Marketo'
+  | 'MicrosoftAccess'
+  | 'MongoDbAtlas'
+  | 'MongoDbV2'
+  | 'MySql'
+  | 'Netezza'
+  | 'ODataRest'
+  | 'Odbc'
+  | 'Office365'
+  | 'OpenAI'
+  | 'Oracle'
+  | 'OracleCloudStorage'
+  | 'OracleServiceCloud'
+  | 'PayPal'
+  | 'Phoenix'
+  | 'PostgreSql'
+  | 'Presto'
+  | 'PythonFeed'
+  | 'QuickBooks'
+  | 'Redis'
+  | 'Responsys'
+  | 'S3'
+  | 'Salesforce'
+  | 'SalesforceMarketingCloud'
+  | 'SalesforceServiceCloud'
+  | 'SapBw'
+  | 'SapCloudForCustomer'
+  | 'SapEcc'
+  | 'SapHana'
+  | 'SapOpenHub'
+  | 'SapTable'
+  | 'Serp'
+  | 'Serverless'
+  | 'ServiceNow'
+  | 'Sftp'
+  | 'SharePointOnlineList'
+  | 'Shopify'
+  | 'Snowflake'
+  | 'Spark'
+  | 'SqlServer'
+  | 'Square'
+  | 'Sybase'
+  | 'Teradata'
+  | 'Vertica'
+  | 'WebTable'
+  | 'Xero'
+  | 'Zoho'
+
+type aadAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'AAD'
+}
+
+type accessKeyAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'AccessKey'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionAccessKeyType
+}
+
+type accountKeyAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'AccountKey'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionAccountKey
+}
+
+type apiKeyAuthWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'ApiKey'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionApiKeyType
+}
+
+type customKeysWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'CustomKeys'
+
+  @description('Required. The credentials for the connection.')
+  credentials: customKeysType
+}
+
+type managedIdentityAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'ManagedIdentity'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionManagedIdentityType
+}
+
+type noneAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'None'
+}
+
+type oauth2AuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'OAuth2'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionOAuth2Type
+}
+
+type patAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'PAT'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionPersonalAccessTokenType
+}
+
+type sasAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'SAS'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionSharedAccessSignatureType
+}
+
+type servicePrincipalAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'ServicePrincipal'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionServicePrincipalType
+}
+
+type usernamePasswordAuthTypeWorkspaceConnectionPropertyType = {
+  @description('Required. The authentication type of the connection target.')
+  authType: 'UsernamePassword'
+
+  @description('Required. The credentials for the connection.')
+  credentials: workspaceConnectionUsernamePasswordType
+}
+
+type customKeysType = {
+  @description('Required. The custom keys for the connection.')
+  keys: {
+    @description('Required. Key-value pairs for the custom keys.')
+    *: string
+  }
+}
+
+type workspaceConnectionAccessKeyType = {
+  @description('Required. The connection access key ID.')
+  accessKeyId: string
+
+  @description('Required. The connection secret access key.')
+  secretAccessKey: string
+}
+
+type workspaceConnectionAccountKey = {
+  @description('Required. The connection key.')
+  key: string
+}
+
+type workspaceConnectionApiKeyType = {
+  @description('Required. The connection API key.')
+  key: string
+}
+
+type workspaceConnectionManagedIdentityType = {
+  @description('Required. The connection managed identity ID.')
+  clientId: string
+
+  @description('Required. The connection managed identity resource ID.')
+  resourceId: string
+}
+
+type workspaceConnectionOAuth2Type = {
+  @description('Conditional. The connection auth URL. Required by Concur connection category.')
+  authUrl: string?
+
+  @minLength(36)
+  @maxLength(36)
+  @description('Required. The connection client ID in the format of UUID.')
+  clientId: string
+
+  @description('Required. The connection client secret.')
+  clientSecret: string
+
+  @description('Conditional. The connection developer token. Required by GoogleAdWords connection category.')
+  developerToken: string?
+
+  @description('Conditional. The connection password. Required by Concur and ServiceNow connection categories where AccessToken grant type is \'Password\'.')
+  password: string?
+
+  @description('Conditional. The connection refresh token. Required by GoogleBigQuery, GoogleAdWords, Hubspot, QuickBooks, Square, Xero and Zoho connection categories.')
+  refreshToken: string?
+
+  @description('Required. The connection tenant ID. Required by QuickBooks and Xero connection categories.')
+  tenantId: string?
+
+  @description('Conditional. The connection username. Required by Concur and ServiceNow connection categories where AccessToken grant type is \'Password\'.')
+  username: string?
+}
+
+type workspaceConnectionPersonalAccessTokenType = {
+  @description('Required. The connection personal access token.')
+  pat: string
+}
+
+type workspaceConnectionSharedAccessSignatureType = {
+  @description('Required. The connection SAS token.')
+  sas: string
+}
+
+type workspaceConnectionServicePrincipalType = {
+  @description('Required. The connection client ID.')
+  clientId: string
+
+  @description('Required. The connection client secret.')
+  clientSecret: string
+
+  @description('Required. The connection tenant ID.')
+  tenantId: string
+}
+
+type workspaceConnectionUsernamePasswordType = {
+  @description('Required. The connection password.')
+  password: string
+
+  @description('Conditional. The connection security token. Required by connections like SalesForce for extra security in addition to \'UsernamePassword\'.')
+  securityToken: string?
+
+  @description('Required. The connection username.')
+  username: string
+}
+
+@secure()
+@export()
+@discriminator('authType')
+type connectionPropertyType =
+  | aadAuthTypeWorkspaceConnectionPropertyType
+  | accessKeyAuthTypeWorkspaceConnectionPropertyType
+  | apiKeyAuthWorkspaceConnectionPropertyType
+  | customKeysWorkspaceConnectionPropertyType
+  | managedIdentityAuthTypeWorkspaceConnectionPropertyType
+  | noneAuthTypeWorkspaceConnectionPropertyType
+  | oauth2AuthTypeWorkspaceConnectionPropertyType
+  | patAuthTypeWorkspaceConnectionPropertyType
+  | sasAuthTypeWorkspaceConnectionPropertyType
+  | servicePrincipalAuthTypeWorkspaceConnectionPropertyType
+  | usernamePasswordAuthTypeWorkspaceConnectionPropertyType
diff --git a/avm/res/machine-learning-services/workspace/connection/main.json b/avm/res/machine-learning-services/workspace/connection/main.json
new file mode 100644
index 0000000000..6e49f757aa
--- /dev/null
+++ b/avm/res/machine-learning-services/workspace/connection/main.json
@@ -0,0 +1,723 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.29.47.4906",
+      "templateHash": "2277907099827503661"
+    },
+    "name": "Machine Learning Services Workspaces Connections",
+    "description": "This module creates a connection in a Machine Learning Services workspace.",
+    "owner": "Azure/module-maintainers"
+  },
+  "definitions": {
+    "metadataType": {
+      "type": "object",
+      "properties": {},
+      "additionalProperties": {
+        "type": "string",
+        "metadata": {
+          "description": "Required. The metadata key-value pairs."
+        }
+      }
+    },
+    "categoryType": {
+      "type": "string",
+      "allowedValues": [
+        "ADLSGen2",
+        "AIServices",
+        "AmazonMws",
+        "AmazonRdsForOracle",
+        "AmazonRdsForSqlServer",
+        "AmazonRedshift",
+        "AmazonS3Compatible",
+        "ApiKey",
+        "AzureBlob",
+        "AzureDataExplorer",
+        "AzureDatabricksDeltaLake",
+        "AzureMariaDb",
+        "AzureMySqlDb",
+        "AzureOneLake",
+        "AzureOpenAI",
+        "AzurePostgresDb",
+        "AzureSqlDb",
+        "AzureSqlMi",
+        "AzureSynapseAnalytics",
+        "AzureTableStorage",
+        "BingLLMSearch",
+        "Cassandra",
+        "CognitiveSearch",
+        "CognitiveService",
+        "Concur",
+        "ContainerRegistry",
+        "CosmosDb",
+        "CosmosDbMongoDbApi",
+        "Couchbase",
+        "CustomKeys",
+        "Db2",
+        "Drill",
+        "Dynamics",
+        "DynamicsAx",
+        "DynamicsCrm",
+        "Eloqua",
+        "FileServer",
+        "FtpServer",
+        "GenericContainerRegistry",
+        "GenericHttp",
+        "GenericRest",
+        "Git",
+        "GoogleAdWords",
+        "GoogleBigQuery",
+        "GoogleCloudStorage",
+        "Greenplum",
+        "Hbase",
+        "Hdfs",
+        "Hive",
+        "Hubspot",
+        "Impala",
+        "Informix",
+        "Jira",
+        "Magento",
+        "MariaDb",
+        "Marketo",
+        "MicrosoftAccess",
+        "MongoDbAtlas",
+        "MongoDbV2",
+        "MySql",
+        "Netezza",
+        "ODataRest",
+        "Odbc",
+        "Office365",
+        "OpenAI",
+        "Oracle",
+        "OracleCloudStorage",
+        "OracleServiceCloud",
+        "PayPal",
+        "Phoenix",
+        "PostgreSql",
+        "Presto",
+        "PythonFeed",
+        "QuickBooks",
+        "Redis",
+        "Responsys",
+        "S3",
+        "Salesforce",
+        "SalesforceMarketingCloud",
+        "SalesforceServiceCloud",
+        "SapBw",
+        "SapCloudForCustomer",
+        "SapEcc",
+        "SapHana",
+        "SapOpenHub",
+        "SapTable",
+        "Serp",
+        "Serverless",
+        "ServiceNow",
+        "Sftp",
+        "SharePointOnlineList",
+        "Shopify",
+        "Snowflake",
+        "Spark",
+        "SqlServer",
+        "Square",
+        "Sybase",
+        "Teradata",
+        "Vertica",
+        "WebTable",
+        "Xero",
+        "Zoho"
+      ],
+      "metadata": {
+        "__bicep_export!": true
+      }
+    },
+    "aadAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "AAD"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        }
+      }
+    },
+    "accessKeyAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "AccessKey"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionAccessKeyType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "accountKeyAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "AccountKey"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionAccountKey",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "apiKeyAuthWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "ApiKey"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionApiKeyType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "customKeysWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "CustomKeys"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/customKeysType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "managedIdentityAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "ManagedIdentity"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionManagedIdentityType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "noneAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "None"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        }
+      }
+    },
+    "oauth2AuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "OAuth2"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionOAuth2Type",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "patAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "PAT"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionPersonalAccessTokenType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "sasAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "SAS"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionSharedAccessSignatureType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "servicePrincipalAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "ServicePrincipal"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionServicePrincipalType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "usernamePasswordAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "UsernamePassword"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/workspaceConnectionUsernamePasswordType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      }
+    },
+    "customKeysType": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "type": "object",
+          "properties": {},
+          "additionalProperties": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. Key-value pairs for the custom keys."
+            }
+          },
+          "metadata": {
+            "description": "Required. The custom keys for the connection."
+          }
+        }
+      }
+    },
+    "workspaceConnectionAccessKeyType": {
+      "type": "object",
+      "properties": {
+        "accessKeyId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection access key ID."
+          }
+        },
+        "secretAccessKey": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection secret access key."
+          }
+        }
+      }
+    },
+    "workspaceConnectionAccountKey": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection key."
+          }
+        }
+      }
+    },
+    "workspaceConnectionApiKeyType": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection API key."
+          }
+        }
+      }
+    },
+    "workspaceConnectionManagedIdentityType": {
+      "type": "object",
+      "properties": {
+        "clientId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection managed identity ID."
+          }
+        },
+        "resourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection managed identity resource ID."
+          }
+        }
+      }
+    },
+    "workspaceConnectionOAuth2Type": {
+      "type": "object",
+      "properties": {
+        "authUrl": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection auth URL. Required by Concur connection category."
+          }
+        },
+        "clientId": {
+          "type": "string",
+          "minLength": 36,
+          "maxLength": 36,
+          "metadata": {
+            "description": "Required. The connection client ID in the format of UUID."
+          }
+        },
+        "clientSecret": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection client secret."
+          }
+        },
+        "developerToken": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection developer token. Required by GoogleAdWords connection category."
+          }
+        },
+        "password": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection password. Required by Concur and ServiceNow connection categories where AccessToken grant type is 'Password'."
+          }
+        },
+        "refreshToken": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection refresh token. Required by GoogleBigQuery, GoogleAdWords, Hubspot, QuickBooks, Square, Xero and Zoho connection categories."
+          }
+        },
+        "tenantId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Required. The connection tenant ID. Required by QuickBooks and Xero connection categories."
+          }
+        },
+        "username": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection username. Required by Concur and ServiceNow connection categories where AccessToken grant type is 'Password'."
+          }
+        }
+      }
+    },
+    "workspaceConnectionPersonalAccessTokenType": {
+      "type": "object",
+      "properties": {
+        "pat": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection personal access token."
+          }
+        }
+      }
+    },
+    "workspaceConnectionSharedAccessSignatureType": {
+      "type": "object",
+      "properties": {
+        "sas": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection SAS token."
+          }
+        }
+      }
+    },
+    "workspaceConnectionServicePrincipalType": {
+      "type": "object",
+      "properties": {
+        "clientId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection client ID."
+          }
+        },
+        "clientSecret": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection client secret."
+          }
+        },
+        "tenantId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection tenant ID."
+          }
+        }
+      }
+    },
+    "workspaceConnectionUsernamePasswordType": {
+      "type": "object",
+      "properties": {
+        "password": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection password."
+          }
+        },
+        "securityToken": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection security token. Required by connections like SalesForce for extra security in addition to 'UsernamePassword'."
+          }
+        },
+        "username": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection username."
+          }
+        }
+      }
+    },
+    "connectionPropertyType": {
+      "type": "secureObject",
+      "discriminator": {
+        "propertyName": "authType",
+        "mapping": {
+          "AAD": {
+            "$ref": "#/definitions/aadAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "AccessKey": {
+            "$ref": "#/definitions/accessKeyAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "ApiKey": {
+            "$ref": "#/definitions/apiKeyAuthWorkspaceConnectionPropertyType"
+          },
+          "CustomKeys": {
+            "$ref": "#/definitions/customKeysWorkspaceConnectionPropertyType"
+          },
+          "ManagedIdentity": {
+            "$ref": "#/definitions/managedIdentityAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "None": {
+            "$ref": "#/definitions/noneAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "OAuth2": {
+            "$ref": "#/definitions/oauth2AuthTypeWorkspaceConnectionPropertyType"
+          },
+          "PAT": {
+            "$ref": "#/definitions/patAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "SAS": {
+            "$ref": "#/definitions/sasAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "ServicePrincipal": {
+            "$ref": "#/definitions/servicePrincipalAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "UsernamePassword": {
+            "$ref": "#/definitions/usernamePasswordAuthTypeWorkspaceConnectionPropertyType"
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_export!": true
+      }
+    }
+  },
+  "parameters": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Name of the connection to create."
+      }
+    },
+    "machineLearningWorkspaceName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment."
+      }
+    },
+    "category": {
+      "$ref": "#/definitions/categoryType",
+      "metadata": {
+        "description": "Required. Category of the connection."
+      }
+    },
+    "expiryTime": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The expiry time of the connection."
+      }
+    },
+    "isSharedToAll": {
+      "type": "bool",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Indicates whether the connection is shared to all users in the workspace."
+      }
+    },
+    "metadata": {
+      "$ref": "#/definitions/metadataType",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. User metadata for the connection."
+      }
+    },
+    "sharedUserList": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The shared user list of the connection."
+      }
+    },
+    "target": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The target of the connection."
+      }
+    },
+    "value": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Value details of the workspace connection."
+      }
+    },
+    "connectionProperties": {
+      "$ref": "#/definitions/connectionPropertyType",
+      "metadata": {
+        "description": "Required. The properties of the connection, specific to the auth type."
+      }
+    }
+  },
+  "resources": {
+    "machineLearningWorkspace": {
+      "existing": true,
+      "type": "Microsoft.MachineLearningServices/workspaces",
+      "apiVersion": "2022-10-01",
+      "name": "[parameters('machineLearningWorkspaceName')]"
+    },
+    "connection": {
+      "type": "Microsoft.MachineLearningServices/workspaces/connections",
+      "apiVersion": "2024-04-01",
+      "name": "[format('{0}/{1}', parameters('machineLearningWorkspaceName'), parameters('name'))]",
+      "properties": "[union(createObject('category', parameters('category'), 'expiryTime', parameters('expiryTime'), 'isSharedToAll', parameters('isSharedToAll'), 'metadata', parameters('metadata'), 'sharedUserList', parameters('sharedUserList'), 'target', parameters('target'), 'value', parameters('value')), parameters('connectionProperties'))]",
+      "dependsOn": [
+        "machineLearningWorkspace"
+      ]
+    }
+  },
+  "outputs": {
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the connection."
+      },
+      "value": "[resourceId('Microsoft.MachineLearningServices/workspaces/connections', parameters('machineLearningWorkspaceName'), parameters('name'))]"
+    },
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the connection."
+      },
+      "value": "[parameters('name')]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the resource group the connection was created in."
+      },
+      "value": "[resourceGroup().name]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/machine-learning-services/workspace/main.bicep b/avm/res/machine-learning-services/workspace/main.bicep
index 572f03195a..6ff05fed5f 100644
--- a/avm/res/machine-learning-services/workspace/main.bicep
+++ b/avm/res/machine-learning-services/workspace/main.bicep
@@ -59,6 +59,9 @@ param privateEndpoints privateEndpointType
 @sys.description('Optional. Computes to create respectively attach to the workspace.')
 param computes array?
 
+@sys.description('Optional. Connections to create in the workspace.')
+param connections connectionType[] = []
+
 @sys.description('Optional. Resource tags.')
 param tags object?
 
@@ -306,6 +309,24 @@ module workspace_computes 'compute/main.bicep' = [
   }
 ]
 
+module workspace_connections 'connection/main.bicep' = [
+  for connection in connections: {
+    name: '${workspace.name}-${connection.name}-connection'
+    params: {
+      machineLearningWorkspaceName: workspace.name
+      name: connection.name
+      category: connection.category
+      expiryTime: connection.?expiryTime
+      isSharedToAll: connection.?isSharedToAll
+      metadata: connection.?metadata
+      sharedUserList: connection.?sharedUserList
+      target: connection.target
+      value: connection.?value
+      connectionProperties: connection.connectionProperties
+    }
+  }
+]
+
 resource workspace_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
   name: lock.?name ?? 'lock-${name}'
   properties: {
@@ -718,3 +739,37 @@ type customerManagedKeyType = {
   @sys.description('Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use.')
   userAssignedIdentityResourceId: string?
 }?
+
+import { categoryType, connectionPropertyType } from 'connection/main.bicep'
+
+type connectionType = {
+  @sys.description('Required. Name of the connection to create.')
+  name: string
+
+  @sys.description('Required. Category of the connection.')
+  category: categoryType
+
+  @sys.description('Optional. The expiry time of the connection.')
+  expiryTime: string?
+
+  @sys.description('Optional. Indicates whether the connection is shared to all users in the workspace.')
+  isSharedToAll: bool?
+
+  @sys.description('Optional. User metadata for the connection.')
+  metadata: {
+    @sys.description('Required. The metadata key-value pairs.')
+    *: string
+  }?
+
+  @sys.description('Optional. The shared user list of the connection.')
+  sharedUserList: string[]?
+
+  @sys.description('Required. The target of the connection.')
+  target: string
+
+  @sys.description('Optional. Value details of the workspace connection.')
+  value: string?
+
+  @sys.description('Required. The properties of the connection, specific to the auth type.')
+  connectionProperties: connectionPropertyType
+}
diff --git a/avm/res/machine-learning-services/workspace/main.json b/avm/res/machine-learning-services/workspace/main.json
index d41096dcad..883c30b6d7 100644
--- a/avm/res/machine-learning-services/workspace/main.json
+++ b/avm/res/machine-learning-services/workspace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "8690832588645488864"
+      "templateHash": "3070187757867486541"
     },
     "name": "Machine Learning Services Workspaces",
     "description": "This module deploys a Machine Learning Services Workspace.",
@@ -777,233 +777,976 @@
         }
       },
       "nullable": true
-    }
-  },
-  "parameters": {
-    "name": {
-      "type": "string",
-      "metadata": {
-        "description": "Required. The name of the machine learning workspace."
-      }
     },
-    "location": {
-      "type": "string",
-      "defaultValue": "[resourceGroup().location]",
-      "metadata": {
-        "description": "Optional. Location for all resources."
+    "connectionType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. Name of the connection to create."
+          }
+        },
+        "category": {
+          "$ref": "#/definitions/categoryType",
+          "metadata": {
+            "description": "Required. Category of the connection."
+          }
+        },
+        "expiryTime": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The expiry time of the connection."
+          }
+        },
+        "isSharedToAll": {
+          "type": "bool",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Indicates whether the connection is shared to all users in the workspace."
+          }
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {},
+          "additionalProperties": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The metadata key-value pairs."
+            }
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. User metadata for the connection."
+          }
+        },
+        "sharedUserList": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The shared user list of the connection."
+          }
+        },
+        "target": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The target of the connection."
+          }
+        },
+        "value": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Value details of the workspace connection."
+          }
+        },
+        "connectionProperties": {
+          "$ref": "#/definitions/connectionPropertyType",
+          "metadata": {
+            "description": "Required. The properties of the connection, specific to the auth type."
+          }
+        }
       }
     },
-    "sku": {
-      "type": "string",
-      "allowedValues": [
-        "Free",
-        "Basic",
-        "Standard",
-        "Premium"
-      ],
+    "_1.aadAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "AAD"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        }
+      },
       "metadata": {
-        "description": "Required. Specifies the SKU, also referred as 'edition' of the Azure Machine Learning workspace."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "kind": {
-      "type": "string",
-      "defaultValue": "Default",
-      "allowedValues": [
-        "Default",
-        "Project",
-        "Hub",
-        "FeatureStore"
-      ],
+    "_1.accessKeyAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "AccessKey"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionAccessKeyType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. The type of Azure Machine Learning workspace to create."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "associatedStorageAccountResourceId": {
-      "type": "string",
-      "nullable": true,
+    "_1.apiKeyAuthWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "ApiKey"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionApiKeyType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Conditional. The resource ID of the associated Storage Account. Required if 'kind' is 'Default', 'FeatureStore' or 'Hub'."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "associatedKeyVaultResourceId": {
-      "type": "string",
-      "nullable": true,
+    "_1.customKeysType": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "type": "object",
+          "properties": {},
+          "additionalProperties": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. Key-value pairs for the custom keys."
+            }
+          },
+          "metadata": {
+            "description": "Required. The custom keys for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Conditional. The resource ID of the associated Key Vault. Required if 'kind' is 'Default', 'FeatureStore' or 'Hub'."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "associatedApplicationInsightsResourceId": {
-      "type": "string",
-      "nullable": true,
+    "_1.customKeysWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "CustomKeys"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.customKeysType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Conditional. The resource ID of the associated Application Insights. Required if 'kind' is 'Default' or 'FeatureStore'."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "associatedContainerRegistryResourceId": {
-      "type": "string",
-      "nullable": true,
+    "_1.managedIdentityAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "ManagedIdentity"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionManagedIdentityType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. The resource ID of the associated Container Registry."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "lock": {
-      "$ref": "#/definitions/lockType",
+    "_1.noneAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "None"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. The lock settings of the service."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "hbiWorkspace": {
-      "type": "bool",
-      "defaultValue": false,
+    "_1.oauth2AuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "OAuth2"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionOAuth2Type",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "hubResourceId": {
-      "type": "string",
-      "nullable": true,
+    "_1.patAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "PAT"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionPersonalAccessTokenType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Conditional. The resource ID of the hub to associate with the workspace. Required if 'kind' is set to 'Project'."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "roleAssignments": {
-      "$ref": "#/definitions/roleAssignmentType",
+    "_1.sasAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "SAS"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionSharedAccessSignatureType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Array of role assignments to create."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "privateEndpoints": {
-      "$ref": "#/definitions/privateEndpointType",
+    "_1.servicePrincipalAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "ServicePrincipal"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionServicePrincipalType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "computes": {
-      "type": "array",
-      "nullable": true,
+    "_1.usernamePasswordAuthTypeWorkspaceConnectionPropertyType": {
+      "type": "object",
+      "properties": {
+        "authType": {
+          "type": "string",
+          "allowedValues": [
+            "UsernamePassword"
+          ],
+          "metadata": {
+            "description": "Required. The authentication type of the connection target."
+          }
+        },
+        "credentials": {
+          "$ref": "#/definitions/_1.workspaceConnectionUsernamePasswordType",
+          "metadata": {
+            "description": "Required. The credentials for the connection."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Computes to create respectively attach to the workspace."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "tags": {
+    "_1.workspaceConnectionAccessKeyType": {
       "type": "object",
-      "nullable": true,
+      "properties": {
+        "accessKeyId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection access key ID."
+          }
+        },
+        "secretAccessKey": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection secret access key."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Resource tags."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "enableTelemetry": {
-      "type": "bool",
-      "defaultValue": true,
+    "_1.workspaceConnectionApiKeyType": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection API key."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Enable/Disable usage telemetry for module."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "managedIdentities": {
-      "$ref": "#/definitions/managedIdentitiesType",
-      "defaultValue": {
-        "systemAssigned": true
+    "_1.workspaceConnectionManagedIdentityType": {
+      "type": "object",
+      "properties": {
+        "clientId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection managed identity ID."
+          }
+        },
+        "resourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection managed identity resource ID."
+          }
+        }
       },
       "metadata": {
-        "description": "Optional. The managed identity definition for this resource. At least one identity type is required."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "featureStoreSettings": {
-      "$ref": "#/definitions/featureStoreSettingType",
+    "_1.workspaceConnectionOAuth2Type": {
+      "type": "object",
+      "properties": {
+        "authUrl": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection auth URL. Required by Concur connection category."
+          }
+        },
+        "clientId": {
+          "type": "string",
+          "minLength": 36,
+          "maxLength": 36,
+          "metadata": {
+            "description": "Required. The connection client ID in the format of UUID."
+          }
+        },
+        "clientSecret": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection client secret."
+          }
+        },
+        "developerToken": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection developer token. Required by GoogleAdWords connection category."
+          }
+        },
+        "password": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection password. Required by Concur and ServiceNow connection categories where AccessToken grant type is 'Password'."
+          }
+        },
+        "refreshToken": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection refresh token. Required by GoogleBigQuery, GoogleAdWords, Hubspot, QuickBooks, Square, Xero and Zoho connection categories."
+          }
+        },
+        "tenantId": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Required. The connection tenant ID. Required by QuickBooks and Xero connection categories."
+          }
+        },
+        "username": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection username. Required by Concur and ServiceNow connection categories where AccessToken grant type is 'Password'."
+          }
+        }
+      },
       "metadata": {
-        "description": "Conditional. Settings for feature store type workspaces. Required if 'kind' is set to 'FeatureStore'."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "managedNetworkSettings": {
-      "$ref": "#/definitions/managedNetworkSettingType",
+    "_1.workspaceConnectionPersonalAccessTokenType": {
+      "type": "object",
+      "properties": {
+        "pat": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection personal access token."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Managed Network settings for a machine learning workspace."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "serverlessComputeSettings": {
-      "$ref": "#/definitions/serverlessComputeSettingType",
+    "_1.workspaceConnectionServicePrincipalType": {
+      "type": "object",
+      "properties": {
+        "clientId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection client ID."
+          }
+        },
+        "clientSecret": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection client secret."
+          }
+        },
+        "tenantId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection tenant ID."
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Settings for serverless compute created in the workspace."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "systemDatastoresAuthMode": {
+    "_1.workspaceConnectionSharedAccessSignatureType": {
+      "type": "object",
+      "properties": {
+        "sas": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection SAS token."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
+      }
+    },
+    "_1.workspaceConnectionUsernamePasswordType": {
+      "type": "object",
+      "properties": {
+        "password": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection password."
+          }
+        },
+        "securityToken": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Conditional. The connection security token. Required by connections like SalesForce for extra security in addition to 'UsernamePassword'."
+          }
+        },
+        "username": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The connection username."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
+      }
+    },
+    "categoryType": {
       "type": "string",
-      "nullable": true,
       "allowedValues": [
-        "accessKey",
-        "identity"
+        "ADLSGen2",
+        "AIServices",
+        "AmazonMws",
+        "AmazonRdsForOracle",
+        "AmazonRdsForSqlServer",
+        "AmazonRedshift",
+        "AmazonS3Compatible",
+        "ApiKey",
+        "AzureBlob",
+        "AzureDataExplorer",
+        "AzureDatabricksDeltaLake",
+        "AzureMariaDb",
+        "AzureMySqlDb",
+        "AzureOneLake",
+        "AzureOpenAI",
+        "AzurePostgresDb",
+        "AzureSqlDb",
+        "AzureSqlMi",
+        "AzureSynapseAnalytics",
+        "AzureTableStorage",
+        "BingLLMSearch",
+        "Cassandra",
+        "CognitiveSearch",
+        "CognitiveService",
+        "Concur",
+        "ContainerRegistry",
+        "CosmosDb",
+        "CosmosDbMongoDbApi",
+        "Couchbase",
+        "CustomKeys",
+        "Db2",
+        "Drill",
+        "Dynamics",
+        "DynamicsAx",
+        "DynamicsCrm",
+        "Eloqua",
+        "FileServer",
+        "FtpServer",
+        "GenericContainerRegistry",
+        "GenericHttp",
+        "GenericRest",
+        "Git",
+        "GoogleAdWords",
+        "GoogleBigQuery",
+        "GoogleCloudStorage",
+        "Greenplum",
+        "Hbase",
+        "Hdfs",
+        "Hive",
+        "Hubspot",
+        "Impala",
+        "Informix",
+        "Jira",
+        "Magento",
+        "MariaDb",
+        "Marketo",
+        "MicrosoftAccess",
+        "MongoDbAtlas",
+        "MongoDbV2",
+        "MySql",
+        "Netezza",
+        "ODataRest",
+        "Odbc",
+        "Office365",
+        "OpenAI",
+        "Oracle",
+        "OracleCloudStorage",
+        "OracleServiceCloud",
+        "PayPal",
+        "Phoenix",
+        "PostgreSql",
+        "Presto",
+        "PythonFeed",
+        "QuickBooks",
+        "Redis",
+        "Responsys",
+        "S3",
+        "Salesforce",
+        "SalesforceMarketingCloud",
+        "SalesforceServiceCloud",
+        "SapBw",
+        "SapCloudForCustomer",
+        "SapEcc",
+        "SapHana",
+        "SapOpenHub",
+        "SapTable",
+        "Serp",
+        "Serverless",
+        "ServiceNow",
+        "Sftp",
+        "SharePointOnlineList",
+        "Shopify",
+        "Snowflake",
+        "Spark",
+        "SqlServer",
+        "Square",
+        "Sybase",
+        "Teradata",
+        "Vertica",
+        "WebTable",
+        "Xero",
+        "Zoho"
       ],
       "metadata": {
-        "description": "Optional. The authentication mode used by the workspace when connecting to the default storage account."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
     },
-    "workspaceHubConfig": {
-      "$ref": "#/definitions/workspaceHubConfigType",
+    "connectionPropertyType": {
+      "type": "secureObject",
+      "discriminator": {
+        "propertyName": "authType",
+        "mapping": {
+          "AAD": {
+            "$ref": "#/definitions/_1.aadAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "AccessKey": {
+            "$ref": "#/definitions/_1.accessKeyAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "ApiKey": {
+            "$ref": "#/definitions/_1.apiKeyAuthWorkspaceConnectionPropertyType"
+          },
+          "CustomKeys": {
+            "$ref": "#/definitions/_1.customKeysWorkspaceConnectionPropertyType"
+          },
+          "ManagedIdentity": {
+            "$ref": "#/definitions/_1.managedIdentityAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "None": {
+            "$ref": "#/definitions/_1.noneAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "OAuth2": {
+            "$ref": "#/definitions/_1.oauth2AuthTypeWorkspaceConnectionPropertyType"
+          },
+          "PAT": {
+            "$ref": "#/definitions/_1.patAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "SAS": {
+            "$ref": "#/definitions/_1.sasAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "ServicePrincipal": {
+            "$ref": "#/definitions/_1.servicePrincipalAuthTypeWorkspaceConnectionPropertyType"
+          },
+          "UsernamePassword": {
+            "$ref": "#/definitions/_1.usernamePasswordAuthTypeWorkspaceConnectionPropertyType"
+          }
+        }
+      },
       "metadata": {
-        "description": "Optional. Configuration for workspace hub settings."
+        "__bicep_imported_from!": {
+          "sourceTemplate": "connection/main.bicep"
+        }
       }
-    },
-    "diagnosticSettings": {
-      "$ref": "#/definitions/diagnosticSettingType",
+    }
+  },
+  "parameters": {
+    "name": {
+      "type": "string",
       "metadata": {
-        "description": "Optional. The diagnostic settings of the service."
+        "description": "Required. The name of the machine learning workspace."
       }
     },
-    "description": {
+    "location": {
       "type": "string",
-      "nullable": true,
+      "defaultValue": "[resourceGroup().location]",
       "metadata": {
-        "description": "Optional. The description of this workspace."
+        "description": "Optional. Location for all resources."
       }
     },
-    "discoveryUrl": {
+    "sku": {
       "type": "string",
-      "nullable": true,
+      "allowedValues": [
+        "Free",
+        "Basic",
+        "Standard",
+        "Premium"
+      ],
       "metadata": {
-        "description": "Optional. URL for the discovery service to identify regional endpoints for machine learning experimentation services."
+        "description": "Required. Specifies the SKU, also referred as 'edition' of the Azure Machine Learning workspace."
       }
     },
-    "customerManagedKey": {
-      "$ref": "#/definitions/customerManagedKeyType",
+    "kind": {
+      "type": "string",
+      "defaultValue": "Default",
+      "allowedValues": [
+        "Default",
+        "Project",
+        "Hub",
+        "FeatureStore"
+      ],
       "metadata": {
-        "description": "Optional. The customer managed key definition."
+        "description": "Optional. The type of Azure Machine Learning workspace to create."
       }
     },
-    "imageBuildCompute": {
+    "associatedStorageAccountResourceId": {
       "type": "string",
       "nullable": true,
       "metadata": {
-        "description": "Optional. The compute name for image build."
+        "description": "Conditional. The resource ID of the associated Storage Account. Required if 'kind' is 'Default', 'FeatureStore' or 'Hub'."
       }
     },
-    "primaryUserAssignedIdentity": {
+    "associatedKeyVaultResourceId": {
       "type": "string",
       "nullable": true,
       "metadata": {
-        "description": "Conditional. The user assigned identity resource ID that represents the workspace identity. Required if 'userAssignedIdentities' is not empty and may not be used if 'systemAssignedIdentity' is enabled."
+        "description": "Conditional. The resource ID of the associated Key Vault. Required if 'kind' is 'Default', 'FeatureStore' or 'Hub'."
       }
     },
-    "serviceManagedResourcesSettings": {
-      "type": "object",
+    "associatedApplicationInsightsResourceId": {
+      "type": "string",
       "nullable": true,
       "metadata": {
-        "description": "Optional. The service managed resource settings."
+        "description": "Conditional. The resource ID of the associated Application Insights. Required if 'kind' is 'Default' or 'FeatureStore'."
       }
     },
-    "sharedPrivateLinkResources": {
-      "type": "array",
+    "associatedContainerRegistryResourceId": {
+      "type": "string",
       "nullable": true,
       "metadata": {
-        "description": "Optional. The list of shared private link resources in this workspace. Note: This property is not idempotent."
+        "description": "Optional. The resource ID of the associated Container Registry."
       }
     },
-    "publicNetworkAccess": {
-      "type": "string",
-      "defaultValue": "Disabled",
-      "allowedValues": [
-        "Enabled",
-        "Disabled"
-      ],
+    "lock": {
+      "$ref": "#/definitions/lockType",
+      "metadata": {
+        "description": "Optional. The lock settings of the service."
+      }
+    },
+    "hbiWorkspace": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. The flag to signal HBI data in the workspace and reduce diagnostic data collected by the service."
+      }
+    },
+    "hubResourceId": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Conditional. The resource ID of the hub to associate with the workspace. Required if 'kind' is set to 'Project'."
+      }
+    },
+    "roleAssignments": {
+      "$ref": "#/definitions/roleAssignmentType",
+      "metadata": {
+        "description": "Optional. Array of role assignments to create."
+      }
+    },
+    "privateEndpoints": {
+      "$ref": "#/definitions/privateEndpointType",
+      "metadata": {
+        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+      }
+    },
+    "computes": {
+      "type": "array",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Computes to create respectively attach to the workspace."
+      }
+    },
+    "connections": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/connectionType"
+      },
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. Connections to create in the workspace."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Resource tags."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for module."
+      }
+    },
+    "managedIdentities": {
+      "$ref": "#/definitions/managedIdentitiesType",
+      "defaultValue": {
+        "systemAssigned": true
+      },
+      "metadata": {
+        "description": "Optional. The managed identity definition for this resource. At least one identity type is required."
+      }
+    },
+    "featureStoreSettings": {
+      "$ref": "#/definitions/featureStoreSettingType",
+      "metadata": {
+        "description": "Conditional. Settings for feature store type workspaces. Required if 'kind' is set to 'FeatureStore'."
+      }
+    },
+    "managedNetworkSettings": {
+      "$ref": "#/definitions/managedNetworkSettingType",
+      "metadata": {
+        "description": "Optional. Managed Network settings for a machine learning workspace."
+      }
+    },
+    "serverlessComputeSettings": {
+      "$ref": "#/definitions/serverlessComputeSettingType",
+      "metadata": {
+        "description": "Optional. Settings for serverless compute created in the workspace."
+      }
+    },
+    "systemDatastoresAuthMode": {
+      "type": "string",
+      "nullable": true,
+      "allowedValues": [
+        "accessKey",
+        "identity"
+      ],
+      "metadata": {
+        "description": "Optional. The authentication mode used by the workspace when connecting to the default storage account."
+      }
+    },
+    "workspaceHubConfig": {
+      "$ref": "#/definitions/workspaceHubConfigType",
+      "metadata": {
+        "description": "Optional. Configuration for workspace hub settings."
+      }
+    },
+    "diagnosticSettings": {
+      "$ref": "#/definitions/diagnosticSettingType",
+      "metadata": {
+        "description": "Optional. The diagnostic settings of the service."
+      }
+    },
+    "description": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The description of this workspace."
+      }
+    },
+    "discoveryUrl": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. URL for the discovery service to identify regional endpoints for machine learning experimentation services."
+      }
+    },
+    "customerManagedKey": {
+      "$ref": "#/definitions/customerManagedKeyType",
+      "metadata": {
+        "description": "Optional. The customer managed key definition."
+      }
+    },
+    "imageBuildCompute": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The compute name for image build."
+      }
+    },
+    "primaryUserAssignedIdentity": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Conditional. The user assigned identity resource ID that represents the workspace identity. Required if 'userAssignedIdentities' is not empty and may not be used if 'systemAssignedIdentity' is enabled."
+      }
+    },
+    "serviceManagedResourcesSettings": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The service managed resource settings."
+      }
+    },
+    "sharedPrivateLinkResources": {
+      "type": "array",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The list of shared private link resources in this workspace. Note: This property is not idempotent."
+      }
+    },
+    "publicNetworkAccess": {
+      "type": "string",
+      "defaultValue": "Disabled",
+      "allowedValues": [
+        "Enabled",
+        "Disabled"
+      ],
       "metadata": {
         "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled."
       }
@@ -1143,48 +1886,320 @@
               "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
             }
           }
-        ],
-        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-      },
-      "dependsOn": [
-        "workspace"
-      ]
-    },
-    "workspace_roleAssignments": {
-      "copy": {
-        "name": "workspace_roleAssignments",
-        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-      },
-      "type": "Microsoft.Authorization/roleAssignments",
-      "apiVersion": "2022-04-01",
-      "scope": "[format('Microsoft.MachineLearningServices/workspaces/{0}', parameters('name'))]",
-      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-      "properties": {
-        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+        ],
+        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+      },
+      "dependsOn": [
+        "workspace"
+      ]
+    },
+    "workspace_roleAssignments": {
+      "copy": {
+        "name": "workspace_roleAssignments",
+        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+      },
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "scope": "[format('Microsoft.MachineLearningServices/workspaces/{0}', parameters('name'))]",
+      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.MachineLearningServices/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+      "properties": {
+        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+      },
+      "dependsOn": [
+        "workspace"
+      ]
+    },
+    "workspace_computes": {
+      "copy": {
+        "name": "workspace_computes",
+        "count": "[length(coalesce(parameters('computes'), createArray()))]"
+      },
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-{1}-compute', parameters('name'), coalesce(parameters('computes'), createArray())[copyIndex()].name)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "machineLearningWorkspaceName": {
+            "value": "[parameters('name')]"
+          },
+          "name": {
+            "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].name]"
+          },
+          "location": {
+            "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].location]"
+          },
+          "sku": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'sku')]"
+          },
+          "managedIdentities": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'managedIdentities')]"
+          },
+          "tags": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'tags')]"
+          },
+          "deployCompute": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'deployCompute')]"
+          },
+          "computeLocation": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'computeLocation')]"
+          },
+          "description": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'description')]"
+          },
+          "disableLocalAuth": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'disableLocalAuth')]"
+          },
+          "resourceId": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'resourceId')]"
+          },
+          "computeType": {
+            "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].computeType]"
+          },
+          "properties": {
+            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'properties')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "8580750401363518569"
+            },
+            "name": "Machine Learning Services Workspaces Computes",
+            "description": "This module deploys a Machine Learning Services Workspaces Compute.\n\nAttaching a compute is not idempotent and will fail in case you try to redeploy over an existing compute in AML (see parameter `deployCompute`).",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "managedIdentitiesType": {
+              "type": "object",
+              "properties": {
+                "systemAssigned": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enables system assigned managed identity on the resource."
+                  }
+                },
+                "userAssignedResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID(s) to assign to the resource."
+                  }
+                }
+              },
+              "nullable": true
+            }
+          },
+          "parameters": {
+            "machineLearningWorkspaceName": {
+              "type": "string",
+              "metadata": {
+                "description": "Conditional. The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment."
+              }
+            },
+            "name": {
+              "type": "string",
+              "minLength": 2,
+              "maxLength": 16,
+              "metadata": {
+                "description": "Required. Name of the compute."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Specifies the location of the resource."
+              }
+            },
+            "sku": {
+              "type": "string",
+              "nullable": true,
+              "allowedValues": [
+                "Basic",
+                "Free",
+                "Premium",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional. Specifies the sku, also referred as \"edition\". Required for creating a compute resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Contains resource tags defined as key-value pairs. Ignored when attaching a compute resource, i.e. when you provide a resource ID."
+              }
+            },
+            "deployCompute": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Flag to specify whether to deploy the compute. Required only for attach (i.e. providing a resource ID), as in this case the operation is not idempotent, i.e. a second deployment will fail. Therefore, this flag needs to be set to \"false\" as long as the compute resource exists."
+              }
+            },
+            "computeLocation": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for the underlying compute. Ignored when attaching a compute resource, i.e. when you provide a resource ID."
+              }
+            },
+            "description": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The description of the Machine Learning compute."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Opt-out of local authentication and ensure customers can use only MSI and AAD exclusively for authentication."
+              }
+            },
+            "resourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. ARM resource ID of the underlying compute."
+              }
+            },
+            "computeType": {
+              "type": "string",
+              "allowedValues": [
+                "AKS",
+                "AmlCompute",
+                "ComputeInstance",
+                "Databricks",
+                "DataFactory",
+                "DataLakeAnalytics",
+                "HDInsight",
+                "Kubernetes",
+                "SynapseSpark",
+                "VirtualMachine"
+              ],
+              "metadata": {
+                "description": "Required. Set the object type."
+              }
+            },
+            "properties": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The properties of the compute. Will be ignored in case \"resourceId\" is set."
+              }
+            },
+            "managedIdentities": {
+              "$ref": "#/definitions/managedIdentitiesType",
+              "metadata": {
+                "description": "Optional. The managed identity definition for this resource."
+              }
+            }
+          },
+          "variables": {
+            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
+          },
+          "resources": {
+            "machineLearningWorkspace": {
+              "existing": true,
+              "type": "Microsoft.MachineLearningServices/workspaces",
+              "apiVersion": "2022-10-01",
+              "name": "[parameters('machineLearningWorkspaceName')]"
+            },
+            "compute": {
+              "condition": "[equals(parameters('deployCompute'), true())]",
+              "type": "Microsoft.MachineLearningServices/workspaces/computes",
+              "apiVersion": "2022-10-01",
+              "name": "[format('{0}/{1}', parameters('machineLearningWorkspaceName'), parameters('name'))]",
+              "location": "[parameters('location')]",
+              "tags": "[if(empty(parameters('resourceId')), parameters('tags'), null())]",
+              "sku": "[if(empty(parameters('resourceId')), createObject('name', parameters('sku'), 'tier', parameters('sku')), null())]",
+              "identity": "[if(empty(parameters('resourceId')), variables('identity'), null())]",
+              "properties": "[union(createObject('description', parameters('description'), 'disableLocalAuth', parameters('disableLocalAuth'), 'computeType', parameters('computeType')), if(not(empty(parameters('resourceId'))), createObject('resourceId', parameters('resourceId')), createObject('computeLocation', parameters('computeLocation'), 'properties', parameters('properties'))))]",
+              "dependsOn": [
+                "machineLearningWorkspace"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the compute."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the compute."
+              },
+              "value": "[resourceId('Microsoft.MachineLearningServices/workspaces/computes', parameters('machineLearningWorkspaceName'), parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the compute was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "The principal ID of the system assigned identity."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('compute', '2022-10-01', 'full'), 'identity'), 'principalId'), '')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('compute', '2022-10-01', 'full').location]"
+            }
+          }
+        }
       },
       "dependsOn": [
-        "workspace"
+        "workspace",
+        "workspace_privateEndpoints"
       ]
     },
-    "workspace_computes": {
+    "workspace_connections": {
       "copy": {
-        "name": "workspace_computes",
-        "count": "[length(coalesce(parameters('computes'), createArray()))]"
+        "name": "workspace_connections",
+        "count": "[length(parameters('connections'))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-{1}-compute', parameters('name'), coalesce(parameters('computes'), createArray())[copyIndex()].name)]",
+      "name": "[format('{0}-{1}-connection', parameters('name'), parameters('connections')[copyIndex()].name)]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
@@ -1195,40 +2210,31 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].name]"
-          },
-          "location": {
-            "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].location]"
-          },
-          "sku": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'sku')]"
+            "value": "[parameters('connections')[copyIndex()].name]"
           },
-          "managedIdentities": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'managedIdentities')]"
-          },
-          "tags": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'tags')]"
+          "category": {
+            "value": "[parameters('connections')[copyIndex()].category]"
           },
-          "deployCompute": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'deployCompute')]"
+          "expiryTime": {
+            "value": "[tryGet(parameters('connections')[copyIndex()], 'expiryTime')]"
           },
-          "computeLocation": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'computeLocation')]"
+          "isSharedToAll": {
+            "value": "[tryGet(parameters('connections')[copyIndex()], 'isSharedToAll')]"
           },
-          "description": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'description')]"
+          "metadata": {
+            "value": "[tryGet(parameters('connections')[copyIndex()], 'metadata')]"
           },
-          "disableLocalAuth": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'disableLocalAuth')]"
+          "sharedUserList": {
+            "value": "[tryGet(parameters('connections')[copyIndex()], 'sharedUserList')]"
           },
-          "resourceId": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'resourceId')]"
+          "target": {
+            "value": "[parameters('connections')[copyIndex()].target]"
           },
-          "computeType": {
-            "value": "[coalesce(parameters('computes'), createArray())[copyIndex()].computeType]"
+          "value": {
+            "value": "[tryGet(parameters('connections')[copyIndex()], 'value')]"
           },
-          "properties": {
-            "value": "[tryGet(coalesce(parameters('computes'), createArray())[copyIndex()], 'properties')]"
+          "connectionProperties": {
+            "value": "[parameters('connections')[copyIndex()].connectionProperties]"
           }
         },
         "template": {
@@ -1239,150 +2245,680 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "8580750401363518569"
+              "templateHash": "2277907099827503661"
+            },
+            "name": "Machine Learning Services Workspaces Connections",
+            "description": "This module creates a connection in a Machine Learning Services workspace.",
+            "owner": "Azure/module-maintainers"
+          },
+          "definitions": {
+            "metadataType": {
+              "type": "object",
+              "properties": {},
+              "additionalProperties": {
+                "type": "string",
+                "metadata": {
+                  "description": "Required. The metadata key-value pairs."
+                }
+              }
+            },
+            "categoryType": {
+              "type": "string",
+              "allowedValues": [
+                "ADLSGen2",
+                "AIServices",
+                "AmazonMws",
+                "AmazonRdsForOracle",
+                "AmazonRdsForSqlServer",
+                "AmazonRedshift",
+                "AmazonS3Compatible",
+                "ApiKey",
+                "AzureBlob",
+                "AzureDataExplorer",
+                "AzureDatabricksDeltaLake",
+                "AzureMariaDb",
+                "AzureMySqlDb",
+                "AzureOneLake",
+                "AzureOpenAI",
+                "AzurePostgresDb",
+                "AzureSqlDb",
+                "AzureSqlMi",
+                "AzureSynapseAnalytics",
+                "AzureTableStorage",
+                "BingLLMSearch",
+                "Cassandra",
+                "CognitiveSearch",
+                "CognitiveService",
+                "Concur",
+                "ContainerRegistry",
+                "CosmosDb",
+                "CosmosDbMongoDbApi",
+                "Couchbase",
+                "CustomKeys",
+                "Db2",
+                "Drill",
+                "Dynamics",
+                "DynamicsAx",
+                "DynamicsCrm",
+                "Eloqua",
+                "FileServer",
+                "FtpServer",
+                "GenericContainerRegistry",
+                "GenericHttp",
+                "GenericRest",
+                "Git",
+                "GoogleAdWords",
+                "GoogleBigQuery",
+                "GoogleCloudStorage",
+                "Greenplum",
+                "Hbase",
+                "Hdfs",
+                "Hive",
+                "Hubspot",
+                "Impala",
+                "Informix",
+                "Jira",
+                "Magento",
+                "MariaDb",
+                "Marketo",
+                "MicrosoftAccess",
+                "MongoDbAtlas",
+                "MongoDbV2",
+                "MySql",
+                "Netezza",
+                "ODataRest",
+                "Odbc",
+                "Office365",
+                "OpenAI",
+                "Oracle",
+                "OracleCloudStorage",
+                "OracleServiceCloud",
+                "PayPal",
+                "Phoenix",
+                "PostgreSql",
+                "Presto",
+                "PythonFeed",
+                "QuickBooks",
+                "Redis",
+                "Responsys",
+                "S3",
+                "Salesforce",
+                "SalesforceMarketingCloud",
+                "SalesforceServiceCloud",
+                "SapBw",
+                "SapCloudForCustomer",
+                "SapEcc",
+                "SapHana",
+                "SapOpenHub",
+                "SapTable",
+                "Serp",
+                "Serverless",
+                "ServiceNow",
+                "Sftp",
+                "SharePointOnlineList",
+                "Shopify",
+                "Snowflake",
+                "Spark",
+                "SqlServer",
+                "Square",
+                "Sybase",
+                "Teradata",
+                "Vertica",
+                "WebTable",
+                "Xero",
+                "Zoho"
+              ],
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "aadAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AAD"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                }
+              }
+            },
+            "accessKeyAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AccessKey"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionAccessKeyType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "accountKeyAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "AccountKey"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionAccountKey",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "apiKeyAuthWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "ApiKey"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionApiKeyType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "customKeysWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CustomKeys"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/customKeysType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "managedIdentityAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "ManagedIdentity"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionManagedIdentityType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "noneAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "None"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                }
+              }
+            },
+            "oauth2AuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "OAuth2"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionOAuth2Type",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "patAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "PAT"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionPersonalAccessTokenType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "sasAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "SAS"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionSharedAccessSignatureType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "servicePrincipalAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "ServicePrincipal"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionServicePrincipalType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "usernamePasswordAuthTypeWorkspaceConnectionPropertyType": {
+              "type": "object",
+              "properties": {
+                "authType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "UsernamePassword"
+                  ],
+                  "metadata": {
+                    "description": "Required. The authentication type of the connection target."
+                  }
+                },
+                "credentials": {
+                  "$ref": "#/definitions/workspaceConnectionUsernamePasswordType",
+                  "metadata": {
+                    "description": "Required. The credentials for the connection."
+                  }
+                }
+              }
+            },
+            "customKeysType": {
+              "type": "object",
+              "properties": {
+                "keys": {
+                  "type": "object",
+                  "properties": {},
+                  "additionalProperties": {
+                    "type": "string",
+                    "metadata": {
+                      "description": "Required. Key-value pairs for the custom keys."
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The custom keys for the connection."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionAccessKeyType": {
+              "type": "object",
+              "properties": {
+                "accessKeyId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection access key ID."
+                  }
+                },
+                "secretAccessKey": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection secret access key."
+                  }
+                }
+              }
             },
-            "name": "Machine Learning Services Workspaces Computes",
-            "description": "This module deploys a Machine Learning Services Workspaces Compute.\n\nAttaching a compute is not idempotent and will fail in case you try to redeploy over an existing compute in AML (see parameter `deployCompute`).",
-            "owner": "Azure/module-maintainers"
-          },
-          "definitions": {
-            "managedIdentitiesType": {
+            "workspaceConnectionAccountKey": {
               "type": "object",
               "properties": {
-                "systemAssigned": {
-                  "type": "bool",
+                "key": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection key."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionApiKeyType": {
+              "type": "object",
+              "properties": {
+                "key": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection API key."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionManagedIdentityType": {
+              "type": "object",
+              "properties": {
+                "clientId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection managed identity ID."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection managed identity resource ID."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionOAuth2Type": {
+              "type": "object",
+              "properties": {
+                "authUrl": {
+                  "type": "string",
                   "nullable": true,
                   "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
+                    "description": "Conditional. The connection auth URL. Required by Concur connection category."
                   }
                 },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
+                "clientId": {
+                  "type": "string",
+                  "minLength": 36,
+                  "maxLength": 36,
+                  "metadata": {
+                    "description": "Required. The connection client ID in the format of UUID."
+                  }
+                },
+                "clientSecret": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection client secret."
+                  }
+                },
+                "developerToken": {
+                  "type": "string",
                   "nullable": true,
                   "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource."
+                    "description": "Conditional. The connection developer token. Required by GoogleAdWords connection category."
+                  }
+                },
+                "password": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The connection password. Required by Concur and ServiceNow connection categories where AccessToken grant type is 'Password'."
+                  }
+                },
+                "refreshToken": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The connection refresh token. Required by GoogleBigQuery, GoogleAdWords, Hubspot, QuickBooks, Square, Xero and Zoho connection categories."
+                  }
+                },
+                "tenantId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Required. The connection tenant ID. Required by QuickBooks and Xero connection categories."
+                  }
+                },
+                "username": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The connection username. Required by Concur and ServiceNow connection categories where AccessToken grant type is 'Password'."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionPersonalAccessTokenType": {
+              "type": "object",
+              "properties": {
+                "pat": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection personal access token."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionSharedAccessSignatureType": {
+              "type": "object",
+              "properties": {
+                "sas": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection SAS token."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionServicePrincipalType": {
+              "type": "object",
+              "properties": {
+                "clientId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection client ID."
+                  }
+                },
+                "clientSecret": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection client secret."
+                  }
+                },
+                "tenantId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection tenant ID."
+                  }
+                }
+              }
+            },
+            "workspaceConnectionUsernamePasswordType": {
+              "type": "object",
+              "properties": {
+                "password": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection password."
+                  }
+                },
+                "securityToken": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Conditional. The connection security token. Required by connections like SalesForce for extra security in addition to 'UsernamePassword'."
+                  }
+                },
+                "username": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The connection username."
+                  }
+                }
+              }
+            },
+            "connectionPropertyType": {
+              "type": "secureObject",
+              "discriminator": {
+                "propertyName": "authType",
+                "mapping": {
+                  "AAD": {
+                    "$ref": "#/definitions/aadAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "AccessKey": {
+                    "$ref": "#/definitions/accessKeyAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "ApiKey": {
+                    "$ref": "#/definitions/apiKeyAuthWorkspaceConnectionPropertyType"
+                  },
+                  "CustomKeys": {
+                    "$ref": "#/definitions/customKeysWorkspaceConnectionPropertyType"
+                  },
+                  "ManagedIdentity": {
+                    "$ref": "#/definitions/managedIdentityAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "None": {
+                    "$ref": "#/definitions/noneAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "OAuth2": {
+                    "$ref": "#/definitions/oauth2AuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "PAT": {
+                    "$ref": "#/definitions/patAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "SAS": {
+                    "$ref": "#/definitions/sasAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "ServicePrincipal": {
+                    "$ref": "#/definitions/servicePrincipalAuthTypeWorkspaceConnectionPropertyType"
+                  },
+                  "UsernamePassword": {
+                    "$ref": "#/definitions/usernamePasswordAuthTypeWorkspaceConnectionPropertyType"
                   }
                 }
               },
-              "nullable": true
+              "metadata": {
+                "__bicep_export!": true
+              }
             }
           },
           "parameters": {
-            "machineLearningWorkspaceName": {
-              "type": "string",
-              "metadata": {
-                "description": "Conditional. The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment."
-              }
-            },
             "name": {
               "type": "string",
-              "minLength": 2,
-              "maxLength": 16,
               "metadata": {
-                "description": "Required. Name of the compute."
+                "description": "Required. Name of the connection to create."
               }
             },
-            "location": {
+            "machineLearningWorkspaceName": {
               "type": "string",
-              "defaultValue": "[resourceGroup().location]",
               "metadata": {
-                "description": "Optional. Specifies the location of the resource."
+                "description": "Required. The name of the parent Machine Learning Workspace. Required if the template is used in a standalone deployment."
               }
             },
-            "sku": {
-              "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Basic",
-                "Free",
-                "Premium",
-                "Standard"
-              ],
+            "category": {
+              "$ref": "#/definitions/categoryType",
               "metadata": {
-                "description": "Optional. Specifies the sku, also referred as \"edition\". Required for creating a compute resource."
+                "description": "Required. Category of the connection."
               }
             },
-            "tags": {
-              "type": "object",
+            "expiryTime": {
+              "type": "string",
               "nullable": true,
               "metadata": {
-                "description": "Optional. Contains resource tags defined as key-value pairs. Ignored when attaching a compute resource, i.e. when you provide a resource ID."
+                "description": "Optional. The expiry time of the connection."
               }
             },
-            "deployCompute": {
+            "isSharedToAll": {
               "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Flag to specify whether to deploy the compute. Required only for attach (i.e. providing a resource ID), as in this case the operation is not idempotent, i.e. a second deployment will fail. Therefore, this flag needs to be set to \"false\" as long as the compute resource exists."
-              }
-            },
-            "computeLocation": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for the underlying compute. Ignored when attaching a compute resource, i.e. when you provide a resource ID."
-              }
-            },
-            "description": {
-              "type": "string",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The description of the Machine Learning compute."
+                "description": "Optional. Indicates whether the connection is shared to all users in the workspace."
               }
             },
-            "disableLocalAuth": {
-              "type": "bool",
-              "defaultValue": false,
+            "metadata": {
+              "$ref": "#/definitions/metadataType",
+              "defaultValue": {},
               "metadata": {
-                "description": "Optional. Opt-out of local authentication and ensure customers can use only MSI and AAD exclusively for authentication."
+                "description": "Optional. User metadata for the connection."
               }
             },
-            "resourceId": {
-              "type": "string",
+            "sharedUserList": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
               "nullable": true,
               "metadata": {
-                "description": "Optional. ARM resource ID of the underlying compute."
+                "description": "Optional. The shared user list of the connection."
               }
             },
-            "computeType": {
+            "target": {
               "type": "string",
-              "allowedValues": [
-                "AKS",
-                "AmlCompute",
-                "ComputeInstance",
-                "Databricks",
-                "DataFactory",
-                "DataLakeAnalytics",
-                "HDInsight",
-                "Kubernetes",
-                "SynapseSpark",
-                "VirtualMachine"
-              ],
               "metadata": {
-                "description": "Required. Set the object type."
+                "description": "Required. The target of the connection."
               }
             },
-            "properties": {
-              "type": "object",
+            "value": {
+              "type": "string",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The properties of the compute. Will be ignored in case \"resourceId\" is set."
+                "description": "Optional. Value details of the workspace connection."
               }
             },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentitiesType",
+            "connectionProperties": {
+              "$ref": "#/definitions/connectionPropertyType",
               "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
+                "description": "Required. The properties of the connection, specific to the auth type."
               }
             }
           },
-          "variables": {
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
-          },
           "resources": {
             "machineLearningWorkspace": {
               "existing": true,
@@ -1390,63 +2926,43 @@
               "apiVersion": "2022-10-01",
               "name": "[parameters('machineLearningWorkspaceName')]"
             },
-            "compute": {
-              "condition": "[equals(parameters('deployCompute'), true())]",
-              "type": "Microsoft.MachineLearningServices/workspaces/computes",
-              "apiVersion": "2022-10-01",
+            "connection": {
+              "type": "Microsoft.MachineLearningServices/workspaces/connections",
+              "apiVersion": "2024-04-01",
               "name": "[format('{0}/{1}', parameters('machineLearningWorkspaceName'), parameters('name'))]",
-              "location": "[parameters('location')]",
-              "tags": "[if(empty(parameters('resourceId')), parameters('tags'), null())]",
-              "sku": "[if(empty(parameters('resourceId')), createObject('name', parameters('sku'), 'tier', parameters('sku')), null())]",
-              "identity": "[if(empty(parameters('resourceId')), variables('identity'), null())]",
-              "properties": "[union(createObject('description', parameters('description'), 'disableLocalAuth', parameters('disableLocalAuth'), 'computeType', parameters('computeType')), if(not(empty(parameters('resourceId'))), createObject('resourceId', parameters('resourceId')), createObject('computeLocation', parameters('computeLocation'), 'properties', parameters('properties'))))]",
+              "properties": "[union(createObject('category', parameters('category'), 'expiryTime', parameters('expiryTime'), 'isSharedToAll', parameters('isSharedToAll'), 'metadata', parameters('metadata'), 'sharedUserList', parameters('sharedUserList'), 'target', parameters('target'), 'value', parameters('value')), parameters('connectionProperties'))]",
               "dependsOn": [
                 "machineLearningWorkspace"
               ]
             }
           },
           "outputs": {
-            "name": {
+            "resourceId": {
               "type": "string",
               "metadata": {
-                "description": "The name of the compute."
+                "description": "The resource ID of the connection."
               },
-              "value": "[parameters('name')]"
+              "value": "[resourceId('Microsoft.MachineLearningServices/workspaces/connections', parameters('machineLearningWorkspaceName'), parameters('name'))]"
             },
-            "resourceId": {
+            "name": {
               "type": "string",
               "metadata": {
-                "description": "The resource ID of the compute."
+                "description": "The name of the connection."
               },
-              "value": "[resourceId('Microsoft.MachineLearningServices/workspaces/computes', parameters('machineLearningWorkspaceName'), parameters('name'))]"
+              "value": "[parameters('name')]"
             },
             "resourceGroupName": {
               "type": "string",
               "metadata": {
-                "description": "The resource group the compute was deployed into."
+                "description": "The name of the resource group the connection was created in."
               },
               "value": "[resourceGroup().name]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[coalesce(tryGet(tryGet(reference('compute', '2022-10-01', 'full'), 'identity'), 'principalId'), '')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('compute', '2022-10-01', 'full').location]"
             }
           }
         }
       },
       "dependsOn": [
-        "workspace",
-        "workspace_privateEndpoints"
+        "workspace"
       ]
     },
     "workspace_privateEndpoints": {
diff --git a/avm/res/machine-learning-services/workspace/tests/e2e/ai/dependencies.bicep b/avm/res/machine-learning-services/workspace/tests/e2e/ai/dependencies.bicep
index 8ea028e953..9a87497d4f 100644
--- a/avm/res/machine-learning-services/workspace/tests/e2e/ai/dependencies.bicep
+++ b/avm/res/machine-learning-services/workspace/tests/e2e/ai/dependencies.bicep
@@ -13,6 +13,9 @@ param storageAccountName string
 @description('Required. The name of the additional Storage Account to create.')
 param secondaryStorageAccountName string
 
+@description('Required. The name of the AI Services to create.')
+param aiServicesName string
+
 resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
   name: keyVaultName
   location: location
@@ -56,6 +59,15 @@ resource secondaryStorageAccount 'Microsoft.Storage/storageAccounts@2021-09-01'
   kind: 'StorageV2'
 }
 
+resource aiServices 'Microsoft.CognitiveServices/accounts@2023-05-01' = {
+  name: aiServicesName
+  location: location
+  sku: {
+    name: 'S0'
+  }
+  kind: 'AIServices'
+}
+
 @description('The resource ID of the created Application Insights instance.')
 output applicationInsightsResourceId string = applicationInsights.id
 
@@ -67,3 +79,12 @@ output secondaryStorageAccountResourceId string = secondaryStorageAccount.id
 
 @description('The resource ID of the created Key Vault.')
 output keyVaultResourceId string = keyVault.id
+
+@description('The resource ID of the created AI Services.')
+output aiServicesResourceId string = aiServices.id
+
+@description('The main endpoint of the created AI Services.')
+output aiServicesEndpoint string = aiServices.properties.endpoint
+
+@description('The endpoints of the created AI Services.')
+output aiServicesEndpoints object = aiServices.properties.endpoints
diff --git a/avm/res/machine-learning-services/workspace/tests/e2e/ai/main.test.bicep b/avm/res/machine-learning-services/workspace/tests/e2e/ai/main.test.bicep
index dea496d17f..8ea4b81b79 100644
--- a/avm/res/machine-learning-services/workspace/tests/e2e/ai/main.test.bicep
+++ b/avm/res/machine-learning-services/workspace/tests/e2e/ai/main.test.bicep
@@ -42,6 +42,7 @@ module nestedDependencies 'dependencies.bicep' = {
     applicationInsightsName: 'dep-${namePrefix}-appI-${serviceShort}'
     storageAccountName: 'dep${namePrefix}st${serviceShort}'
     secondaryStorageAccountName: 'dep${namePrefix}st${serviceShort}2'
+    aiServicesName: 'dep-${namePrefix}-ai-${serviceShort}'
     location: resourceLocation
   }
 }
@@ -63,6 +64,26 @@ module testDeployment '../../../main.bicep' = [
       associatedStorageAccountResourceId: nestedDependencies.outputs.storageAccountResourceId
       sku: 'Basic'
       kind: 'Hub'
+      connections: [
+        {
+          name: 'ai'
+          category: 'AIServices'
+          target: nestedDependencies.outputs.aiServicesEndpoint
+          connectionProperties: {
+            authType: 'ApiKey'
+            credentials: {
+              key: 'key'
+            }
+          }
+          metadata: {
+            ApiType: 'Azure'
+            ResourceId: nestedDependencies.outputs.aiServicesResourceId
+            Location: resourceLocation
+            ApiVersion: '2023-07-01-preview'
+            DeploymentApiVersion: '2023-10-01-preview'
+          }
+        }
+      ]
       workspaceHubConfig: {
         additionalWorkspaceStorageAccounts: [nestedDependencies.outputs.secondaryStorageAccountResourceId]
         defaultWorkspaceResourceGroup: resourceGroup.id
diff --git a/avm/res/machine-learning-services/workspace/tests/e2e/max/main.test.bicep b/avm/res/machine-learning-services/workspace/tests/e2e/max/main.test.bicep
index 65e1654ec1..56119cb3d1 100644
--- a/avm/res/machine-learning-services/workspace/tests/e2e/max/main.test.bicep
+++ b/avm/res/machine-learning-services/workspace/tests/e2e/max/main.test.bicep
@@ -108,6 +108,19 @@ module testDeployment '../../../main.bicep' = [
           }
         }
       ]
+      connections: [
+        {
+          name: 'connection'
+          category: 'ApiKey'
+          target: 'https://example.com'
+          connectionProperties: {
+            authType: 'ApiKey'
+            credentials: {
+              key: 'key'
+            }
+          }
+        }
+      ]
       description: 'The cake is a lie.'
       diagnosticSettings: [
         {
diff --git a/avm/res/machine-learning-services/workspace/version.json b/avm/res/machine-learning-services/workspace/version.json
index e42c3d9e5f..a89e5c9d3c 100644
--- a/avm/res/machine-learning-services/workspace/version.json
+++ b/avm/res/machine-learning-services/workspace/version.json
@@ -1,7 +1,7 @@
 {
-    "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.6",
-    "pathFilters": [
-        "./main.json"
-    ]
-}
\ No newline at end of file
+  "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
+  "version": "0.7",
+  "pathFilters": [
+    "./main.json"
+  ]
+}
diff --git a/avm/res/managed-services/registration-definition/README.md b/avm/res/managed-services/registration-definition/README.md
index d4f5ad9979..85cea5188b 100644
--- a/avm/res/managed-services/registration-definition/README.md
+++ b/avm/res/managed-services/registration-definition/README.md
@@ -61,7 +61,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
         roleDefinitionId: '91c1777a-f3dc-4fae-b103-61d183457e46'
       }
     ]
-    managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+    managedByTenantId: '<managedByTenantId>'
     name: 'Component Validation - msrdmin Subscription assignment'
     registrationDescription: 'Managed by Lighthouse'
     // Non-required parameters
@@ -96,7 +96,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
       ]
     },
     "managedByTenantId": {
-      "value": "449fbe1d-9c99-4509-9014-4fd5cf25b014"
+      "value": "<managedByTenantId>"
     },
     "name": {
       "value": "Component Validation - msrdmin Subscription assignment"
@@ -148,7 +148,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
         roleDefinitionId: '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9'
       }
     ]
-    managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+    managedByTenantId: '<managedByTenantId>'
     name: 'Component Validation - msrdmax Subscription assignment'
     registrationDescription: 'Managed by Lighthouse'
     // Non-required parameters
@@ -193,7 +193,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
       ]
     },
     "managedByTenantId": {
-      "value": "449fbe1d-9c99-4509-9014-4fd5cf25b014"
+      "value": "<managedByTenantId>"
     },
     "name": {
       "value": "Component Validation - msrdmax Subscription assignment"
@@ -239,7 +239,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
         roleDefinitionId: '91c1777a-f3dc-4fae-b103-61d183457e46'
       }
     ]
-    managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+    managedByTenantId: '<managedByTenantId>'
     name: 'Component Validation - msrdrg Subscription assignment'
     registrationDescription: 'Managed by Lighthouse'
     // Non-required parameters
@@ -276,7 +276,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
       ]
     },
     "managedByTenantId": {
-      "value": "449fbe1d-9c99-4509-9014-4fd5cf25b014"
+      "value": "<managedByTenantId>"
     },
     "name": {
       "value": "Component Validation - msrdrg Subscription assignment"
@@ -325,7 +325,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
         roleDefinitionId: '91c1777a-f3dc-4fae-b103-61d183457e46'
       }
     ]
-    managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+    managedByTenantId: '<managedByTenantId>'
     name: 'Component Validation - msrdwaf Subscription assignment'
     registrationDescription: 'Managed by Lighthouse'
     // Non-required parameters
@@ -361,7 +361,7 @@ module registrationDefinition 'br/public:avm/res/managed-services/registration-d
       ]
     },
     "managedByTenantId": {
-      "value": "449fbe1d-9c99-4509-9014-4fd5cf25b014"
+      "value": "<managedByTenantId>"
     },
     "name": {
       "value": "Component Validation - msrdwaf Subscription assignment"
diff --git a/avm/res/managed-services/registration-definition/tests/e2e/defaults/main.test.bicep b/avm/res/managed-services/registration-definition/tests/e2e/defaults/main.test.bicep
index 0c64dc087e..47ad05d1b6 100644
--- a/avm/res/managed-services/registration-definition/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/managed-services/registration-definition/tests/e2e/defaults/main.test.bicep
@@ -16,6 +16,10 @@ param resourceLocation string = deployment().location
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The tenant Id of the lighthouse tenant. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-LighthouseManagedByTenantId\'.')
+@secure()
+param lighthouseManagedByTenantId string = ''
+
 // ============== //
 // Test Execution //
 // ============== //
@@ -38,7 +42,7 @@ module testDeployment '../../../main.bicep' = [
           roleDefinitionId: '91c1777a-f3dc-4fae-b103-61d183457e46'
         }
       ]
-      managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+      managedByTenantId: lighthouseManagedByTenantId
     }
   }
 ]
diff --git a/avm/res/managed-services/registration-definition/tests/e2e/max/main.test.bicep b/avm/res/managed-services/registration-definition/tests/e2e/max/main.test.bicep
index 17fdc6a502..f8f3cb2958 100644
--- a/avm/res/managed-services/registration-definition/tests/e2e/max/main.test.bicep
+++ b/avm/res/managed-services/registration-definition/tests/e2e/max/main.test.bicep
@@ -16,6 +16,10 @@ param resourceLocation string = deployment().location
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The tenant Id of the lighthouse tenant. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-LighthouseManagedByTenantId\'.')
+@secure()
+param lighthouseManagedByTenantId string = ''
+
 // ============== //
 // Test Execution //
 // ============== //
@@ -48,7 +52,7 @@ module testDeployment '../../../main.bicep' = [
           roleDefinitionId: '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9' // User Access Administrator
         }
       ]
-      managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+      managedByTenantId: lighthouseManagedByTenantId
     }
   }
 ]
diff --git a/avm/res/managed-services/registration-definition/tests/e2e/rg/main.test.bicep b/avm/res/managed-services/registration-definition/tests/e2e/rg/main.test.bicep
index 710d6a08ce..979aa9f048 100644
--- a/avm/res/managed-services/registration-definition/tests/e2e/rg/main.test.bicep
+++ b/avm/res/managed-services/registration-definition/tests/e2e/rg/main.test.bicep
@@ -20,6 +20,10 @@ param resourceLocation string = deployment().location
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The tenant Id of the lighthouse tenant. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-LighthouseManagedByTenantId\'.')
+@secure()
+param lighthouseManagedByTenantId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -61,7 +65,7 @@ module testDeployment '../../../main.bicep' = [
           roleDefinitionId: '91c1777a-f3dc-4fae-b103-61d183457e46'
         }
       ]
-      managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+      managedByTenantId: lighthouseManagedByTenantId
     }
   }
 ]
diff --git a/avm/res/managed-services/registration-definition/tests/e2e/waf-aligned/main.test.bicep b/avm/res/managed-services/registration-definition/tests/e2e/waf-aligned/main.test.bicep
index add8fba41d..9e733740da 100644
--- a/avm/res/managed-services/registration-definition/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/managed-services/registration-definition/tests/e2e/waf-aligned/main.test.bicep
@@ -20,6 +20,10 @@ param resourceLocation string = deployment().location
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Required. The tenant Id of the lighthouse tenant. This value is tenant-specific and must be stored in the CI Key Vault in a secret named \'CI-LighthouseManagedByTenantId\'.')
+@secure()
+param lighthouseManagedByTenantId string = ''
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -54,7 +58,7 @@ module testDeployment '../../../main.bicep' = [
           roleDefinitionId: '91c1777a-f3dc-4fae-b103-61d183457e46'
         }
       ]
-      managedByTenantId: '449fbe1d-9c99-4509-9014-4fd5cf25b014'
+      managedByTenantId: lighthouseManagedByTenantId
     }
   }
 ]
diff --git a/avm/res/net-app/net-app-account/README.md b/avm/res/net-app/net-app-account/README.md
index 932b36d773..7ee4003cbe 100644
--- a/avm/res/net-app/net-app-account/README.md
+++ b/avm/res/net-app/net-app-account/README.md
@@ -16,12 +16,13 @@ This module deploys an Azure NetApp File.
 | :-- | :-- |
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.NetApp/netAppAccounts` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-07-01/netAppAccounts) |
-| `Microsoft.NetApp/netAppAccounts/backupPolicies` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-11-01/netAppAccounts/backupPolicies) |
-| `Microsoft.NetApp/netAppAccounts/backupVaults` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-05-01-preview/netAppAccounts/backupVaults) |
-| `Microsoft.NetApp/netAppAccounts/backupVaults/backups` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-05-01-preview/netAppAccounts/backupVaults/backups) |
-| `Microsoft.NetApp/netAppAccounts/capacityPools` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-07-01/netAppAccounts/capacityPools) |
-| `Microsoft.NetApp/netAppAccounts/capacityPools/volumes` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-07-01/netAppAccounts/capacityPools/volumes) |
+| `Microsoft.NetApp/netAppAccounts` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts) |
+| `Microsoft.NetApp/netAppAccounts/backupPolicies` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupPolicies) |
+| `Microsoft.NetApp/netAppAccounts/backupVaults` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupVaults) |
+| `Microsoft.NetApp/netAppAccounts/backupVaults/backups` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupVaults/backups) |
+| `Microsoft.NetApp/netAppAccounts/capacityPools` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/capacityPools) |
+| `Microsoft.NetApp/netAppAccounts/capacityPools/volumes` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/capacityPools/volumes) |
+| `Microsoft.NetApp/netAppAccounts/snapshotPolicies` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/snapshotPolicies) |
 
 ## Usage examples
 
@@ -114,6 +115,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
         size: 4398046511104
         volumes: [
           {
+            encryptionKeySource: '<encryptionKeySource>'
             exportPolicyRules: [
               {
                 allowedClients: '0.0.0.0/0'
@@ -143,6 +145,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
             ]
           }
           {
+            encryptionKeySource: '<encryptionKeySource>'
             exportPolicyRules: [
               {
                 allowedClients: '0.0.0.0/0'
@@ -250,6 +253,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
           "size": 4398046511104,
           "volumes": [
             {
+              "encryptionKeySource": "<encryptionKeySource>",
               "exportPolicyRules": [
                 {
                   "allowedClients": "0.0.0.0/0",
@@ -279,6 +283,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
               ]
             },
             {
+              "encryptionKeySource": "<encryptionKeySource>",
               "exportPolicyRules": [
                 {
                   "allowedClients": "0.0.0.0/0",
@@ -396,6 +401,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
         size: 4398046511104
         volumes: [
           {
+            encryptionKeySource: '<encryptionKeySource>'
             exportPolicyRules: [
               {
                 allowedClients: '0.0.0.0/0'
@@ -425,6 +431,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
             ]
           }
           {
+            encryptionKeySource: '<encryptionKeySource>'
             name: 'nanaanfs3-vol-002'
             networkFeatures: 'Standard'
             protocolTypes: [
@@ -519,6 +526,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
           "size": 4398046511104,
           "volumes": [
             {
+              "encryptionKeySource": "<encryptionKeySource>",
               "exportPolicyRules": [
                 {
                   "allowedClients": "0.0.0.0/0",
@@ -548,6 +556,7 @@ module netAppAccount 'br/public:avm/res/net-app/net-app-account:<version>' = {
               ]
             },
             {
+              "encryptionKeySource": "<encryptionKeySource>",
               "name": "nanaanfs3-vol-002",
               "networkFeatures": "Standard",
               "protocolTypes": [
diff --git a/avm/res/net-app/net-app-account/capacity-pool/README.md b/avm/res/net-app/net-app-account/capacity-pool/README.md
index 189c8064b2..e8d582aa36 100644
--- a/avm/res/net-app/net-app-account/capacity-pool/README.md
+++ b/avm/res/net-app/net-app-account/capacity-pool/README.md
@@ -13,11 +13,12 @@ This module deploys an Azure NetApp Files Capacity Pool.
 | Resource Type | API Version |
 | :-- | :-- |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.NetApp/netAppAccounts/backupPolicies` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-11-01/netAppAccounts/backupPolicies) |
-| `Microsoft.NetApp/netAppAccounts/backupVaults` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-05-01-preview/netAppAccounts/backupVaults) |
-| `Microsoft.NetApp/netAppAccounts/backupVaults/backups` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-05-01-preview/netAppAccounts/backupVaults/backups) |
-| `Microsoft.NetApp/netAppAccounts/capacityPools` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-07-01/netAppAccounts/capacityPools) |
-| `Microsoft.NetApp/netAppAccounts/capacityPools/volumes` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-07-01/netAppAccounts/capacityPools/volumes) |
+| `Microsoft.NetApp/netAppAccounts/backupPolicies` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupPolicies) |
+| `Microsoft.NetApp/netAppAccounts/backupVaults` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupVaults) |
+| `Microsoft.NetApp/netAppAccounts/backupVaults/backups` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupVaults/backups) |
+| `Microsoft.NetApp/netAppAccounts/capacityPools` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/capacityPools) |
+| `Microsoft.NetApp/netAppAccounts/capacityPools/volumes` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/capacityPools/volumes) |
+| `Microsoft.NetApp/netAppAccounts/snapshotPolicies` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/snapshotPolicies) |
 
 ## Parameters
 
diff --git a/avm/res/net-app/net-app-account/capacity-pool/main.bicep b/avm/res/net-app/net-app-account/capacity-pool/main.bicep
index 921c478b84..60125cc62f 100644
--- a/avm/res/net-app/net-app-account/capacity-pool/main.bicep
+++ b/avm/res/net-app/net-app-account/capacity-pool/main.bicep
@@ -77,11 +77,11 @@ var formattedRoleAssignments = [
   })
 ]
 
-resource netAppAccount 'Microsoft.NetApp/netAppAccounts@2023-07-01' existing = {
+resource netAppAccount 'Microsoft.NetApp/netAppAccounts@2024-03-01' existing = {
   name: netAppAccountName
 }
 
-resource capacityPool 'Microsoft.NetApp/netAppAccounts/capacityPools@2023-07-01' = {
+resource capacityPool 'Microsoft.NetApp/netAppAccounts/capacityPools@2024-03-01' = {
   name: name
   parent: netAppAccount
   location: location
@@ -105,36 +105,58 @@ module capacityPool_volumes 'volume/main.bicep' = [
       name: volume.name
       location: location
       serviceLevel: serviceLevel
-      creationToken: contains(volume, 'creationToken') ? volume.creationToken : volume.name
+      creationToken: volume.?creationToken ?? volume.name
       usageThreshold: volume.usageThreshold
-      protocolTypes: contains(volume, 'protocolTypes') ? volume.protocolTypes : []
+      protocolTypes: volume.?protocolTypes ?? []
       subnetResourceId: volume.subnetResourceId
-      exportPolicyRules: contains(volume, 'exportPolicyRules') ? volume.exportPolicyRules : []
-      roleAssignments: contains(volume, 'roleAssignments') ? volume.roleAssignments : []
+      exportPolicyRules: volume.?exportPolicyRules ?? []
+      roleAssignments: volume.?roleAssignments ?? []
       networkFeatures: volume.?networkFeatures
       zones: volume.?zones
-      coolAccess: contains(volume, 'coolAccess') ? volume.coolAccess : false
-      coolAccessRetrievalPolicy: contains(volume, 'coolAccessRetrievalPolicy')
-        ? volume.coolAccessRetrievalPolicy
-        : 'Default'
-      coolnessPeriod: contains(volume, 'coolnessPeriod') ? volume.coolnessPeriod : 0
-      endpointType: contains(volume, 'endpointType') ? volume.endpointType : ''
-      remoteVolumeRegion: contains(volume, 'remoteVolumeRegion') ? volume.remoteVolumeRegion : ''
-      remoteVolumeResourceId: contains(volume, 'remoteVolumeResourceId') ? volume.remoteVolumeResourceId : ''
-      replicationSchedule: contains(volume, 'replicationSchedule') ? volume.replicationSchedule : ''
-      backupPolicyName: contains(volume, 'backupPolicyName') ? volume.backupPolicyName : 'backupPolicy'
-      backupPolicyLocation: contains(volume, 'backupPolicyLocation') ? volume.backupPolicyLocation : ''
-      dailyBackupsToKeep: contains(volume, 'dailyBackupsToKeep') ? volume.dailyBackupsToKeep : 0
-      backupEnabled: contains(volume, 'backupEnabled') ? volume.backupEnabled : false
-      monthlyBackupsToKeep: contains(volume, 'monthlyBackupsToKeep') ? volume.monthlyBackupsToKeep : 0
-      weeklyBackupsToKeep: contains(volume, 'weeklyBackupsToKeep') ? volume.weeklyBackupsToKeep : 0
-      backupVaultName: contains(volume, 'backupVaultName') ? volume.backupVaultName : 'vault'
-      backupVaultLocation: contains(volume, 'backupVaultLocation') ? volume.backupVaultLocation : ''
-      backupName: contains(volume, 'backupName') ? volume.backupName : 'backup'
-      backupLabel: contains(volume, 'backupLabel') ? volume.backupLabel : ''
-      snapshotName: contains(volume, 'snapshotName') ? volume.snapshotName : 'snapshot'
-      useExistingSnapshot: contains(volume, 'useExistingSnapshot') ? volume.useExistingSnapshot : false
-      volumeResourceId: contains(volume, 'volumeResourceId') ? volume.volumeResourceId : ''
+      coolAccess: volume.?coolAccess ?? false
+      coolAccessRetrievalPolicy: volume.?coolAccessRetrievalPolicy ?? 'Default'
+      coolnessPeriod: volume.?coolnessPeriod ?? 0
+      encryptionKeySource: volume.?encryptionKeySource ?? 'Microsoft.NetApp'
+      keyVaultPrivateEndpointResourceId: volume.?keyVaultPrivateEndpointResourceId ?? ''
+      endpointType: volume.?endpointType ?? ''
+      remoteVolumeRegion: volume.?remoteVolumeRegion ?? ''
+      remoteVolumeResourceId: volume.?remoteVolumeResourceId ?? ''
+      replicationSchedule: volume.?replicationSchedule ?? ''
+      snapshotPolicyId: volume.?snapshotPolicyId ?? ''
+      snapshotPolicyName: volume.?snapshotPolicyName ?? 'snapshotPolicy'
+      snapshotPolicyLocation: volume.?snapshotPolicyLocation ?? ''
+      snapEnabled: volume.?snapEnabled ?? false
+      dailyHour: volume.?dailyHour ?? 0
+      dailyMinute: volume.?dailyMinute ?? 0
+      dailySnapshotsToKeep: volume.?dailySnapshotsToKeep ?? 0
+      dailyUsedBytes: volume.?dailyUsedBytes ?? 0
+      hourlyMinute: volume.?hourlyMinute ?? 0
+      hourlySnapshotsToKeep: volume.?hourlySnapshotsToKeep ?? 0
+      hourlyUsedBytes: volume.?hourlyUsedBytes ?? 0
+      daysOfMonth: volume.?daysOfMonth ?? ''
+      monthlyHour: volume.?monthlyHour ?? 0
+      monthlyMinute: volume.?monthlyMinute ?? 0
+      monthlySnapshotsToKeep: volume.?monthlySnapshotsToKeep ?? 0
+      monthlyUsedBytes: volume.?monthlyUsedBytes ?? 0
+      weeklyDay: volume.?weeklyDay ?? ''
+      weeklyHour: volume.?weeklyHour ?? 0
+      weeklyMinute: volume.?weeklyMinute ?? 0
+      weeklySnapshotsToKeep: volume.?weeklySnapshotsToKeep ?? 0
+      weeklyUsedBytes: volume.?weeklyUsedBytes ?? 0
+      backupPolicyName: volume.?backupPolicyName ?? 'backupPolicy'
+      backupPolicyLocation: volume.?backupPolicyLocation ?? ''
+      dailyBackupsToKeep: volume.?dailyBackupsToKeep ?? 0
+      backupEnabled: volume.?backupEnabled ?? false
+      monthlyBackupsToKeep: volume.?monthlyBackupsToKeep ?? 0
+      weeklyBackupsToKeep: volume.?weeklyBackupsToKeep ?? 0
+      backupVaultName: volume.?backupVaultName ?? 'vault'
+      backupVaultLocation: volume.?backupVaultLocation ?? ''
+      backupName: volume.?backupName ?? 'backup'
+      backupLabel: volume.?backupLabel ?? ''
+      snapshotName: volume.?snapshotName ?? 'snapshot'
+      useExistingSnapshot: volume.?useExistingSnapshot ?? false
+      volumeResourceId: volume.?volumeResourceId ?? ''
+      volumeType: volume.?volumeType ?? ''
     }
   }
 ]
diff --git a/avm/res/net-app/net-app-account/capacity-pool/main.json b/avm/res/net-app/net-app-account/capacity-pool/main.json
index 8492c2efec..b8ed42b918 100644
--- a/avm/res/net-app/net-app-account/capacity-pool/main.json
+++ b/avm/res/net-app/net-app-account/capacity-pool/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "2003436184027921318"
+      "templateHash": "2991493712029822030"
     },
     "name": "Azure NetApp Files Capacity Pools",
     "description": "This module deploys an Azure NetApp Files Capacity Pool.",
@@ -203,12 +203,12 @@
     "netAppAccount": {
       "existing": true,
       "type": "Microsoft.NetApp/netAppAccounts",
-      "apiVersion": "2023-07-01",
+      "apiVersion": "2024-03-01",
       "name": "[parameters('netAppAccountName')]"
     },
     "capacityPool": {
       "type": "Microsoft.NetApp/netAppAccounts/capacityPools",
-      "apiVersion": "2023-07-01",
+      "apiVersion": "2024-03-01",
       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('name'))]",
       "location": "[parameters('location')]",
       "tags": "[parameters('tags')]",
@@ -276,42 +276,162 @@
           "serviceLevel": {
             "value": "[parameters('serviceLevel')]"
           },
-          "creationToken": "[if(contains(parameters('volumes')[copyIndex()], 'creationToken'), createObject('value', parameters('volumes')[copyIndex()].creationToken), createObject('value', parameters('volumes')[copyIndex()].name))]",
+          "creationToken": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'creationToken'), parameters('volumes')[copyIndex()].name)]"
+          },
           "usageThreshold": {
             "value": "[parameters('volumes')[copyIndex()].usageThreshold]"
           },
-          "protocolTypes": "[if(contains(parameters('volumes')[copyIndex()], 'protocolTypes'), createObject('value', parameters('volumes')[copyIndex()].protocolTypes), createObject('value', createArray()))]",
+          "protocolTypes": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'protocolTypes'), createArray())]"
+          },
           "subnetResourceId": {
             "value": "[parameters('volumes')[copyIndex()].subnetResourceId]"
           },
-          "exportPolicyRules": "[if(contains(parameters('volumes')[copyIndex()], 'exportPolicyRules'), createObject('value', parameters('volumes')[copyIndex()].exportPolicyRules), createObject('value', createArray()))]",
-          "roleAssignments": "[if(contains(parameters('volumes')[copyIndex()], 'roleAssignments'), createObject('value', parameters('volumes')[copyIndex()].roleAssignments), createObject('value', createArray()))]",
+          "exportPolicyRules": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'exportPolicyRules'), createArray())]"
+          },
+          "roleAssignments": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'roleAssignments'), createArray())]"
+          },
           "networkFeatures": {
             "value": "[tryGet(parameters('volumes')[copyIndex()], 'networkFeatures')]"
           },
           "zones": {
             "value": "[tryGet(parameters('volumes')[copyIndex()], 'zones')]"
           },
-          "coolAccess": "[if(contains(parameters('volumes')[copyIndex()], 'coolAccess'), createObject('value', parameters('volumes')[copyIndex()].coolAccess), createObject('value', false()))]",
-          "coolAccessRetrievalPolicy": "[if(contains(parameters('volumes')[copyIndex()], 'coolAccessRetrievalPolicy'), createObject('value', parameters('volumes')[copyIndex()].coolAccessRetrievalPolicy), createObject('value', 'Default'))]",
-          "coolnessPeriod": "[if(contains(parameters('volumes')[copyIndex()], 'coolnessPeriod'), createObject('value', parameters('volumes')[copyIndex()].coolnessPeriod), createObject('value', 0))]",
-          "endpointType": "[if(contains(parameters('volumes')[copyIndex()], 'endpointType'), createObject('value', parameters('volumes')[copyIndex()].endpointType), createObject('value', ''))]",
-          "remoteVolumeRegion": "[if(contains(parameters('volumes')[copyIndex()], 'remoteVolumeRegion'), createObject('value', parameters('volumes')[copyIndex()].remoteVolumeRegion), createObject('value', ''))]",
-          "remoteVolumeResourceId": "[if(contains(parameters('volumes')[copyIndex()], 'remoteVolumeResourceId'), createObject('value', parameters('volumes')[copyIndex()].remoteVolumeResourceId), createObject('value', ''))]",
-          "replicationSchedule": "[if(contains(parameters('volumes')[copyIndex()], 'replicationSchedule'), createObject('value', parameters('volumes')[copyIndex()].replicationSchedule), createObject('value', ''))]",
-          "backupPolicyName": "[if(contains(parameters('volumes')[copyIndex()], 'backupPolicyName'), createObject('value', parameters('volumes')[copyIndex()].backupPolicyName), createObject('value', 'backupPolicy'))]",
-          "backupPolicyLocation": "[if(contains(parameters('volumes')[copyIndex()], 'backupPolicyLocation'), createObject('value', parameters('volumes')[copyIndex()].backupPolicyLocation), createObject('value', ''))]",
-          "dailyBackupsToKeep": "[if(contains(parameters('volumes')[copyIndex()], 'dailyBackupsToKeep'), createObject('value', parameters('volumes')[copyIndex()].dailyBackupsToKeep), createObject('value', 0))]",
-          "backupEnabled": "[if(contains(parameters('volumes')[copyIndex()], 'backupEnabled'), createObject('value', parameters('volumes')[copyIndex()].backupEnabled), createObject('value', false()))]",
-          "monthlyBackupsToKeep": "[if(contains(parameters('volumes')[copyIndex()], 'monthlyBackupsToKeep'), createObject('value', parameters('volumes')[copyIndex()].monthlyBackupsToKeep), createObject('value', 0))]",
-          "weeklyBackupsToKeep": "[if(contains(parameters('volumes')[copyIndex()], 'weeklyBackupsToKeep'), createObject('value', parameters('volumes')[copyIndex()].weeklyBackupsToKeep), createObject('value', 0))]",
-          "backupVaultName": "[if(contains(parameters('volumes')[copyIndex()], 'backupVaultName'), createObject('value', parameters('volumes')[copyIndex()].backupVaultName), createObject('value', 'vault'))]",
-          "backupVaultLocation": "[if(contains(parameters('volumes')[copyIndex()], 'backupVaultLocation'), createObject('value', parameters('volumes')[copyIndex()].backupVaultLocation), createObject('value', ''))]",
-          "backupName": "[if(contains(parameters('volumes')[copyIndex()], 'backupName'), createObject('value', parameters('volumes')[copyIndex()].backupName), createObject('value', 'backup'))]",
-          "backupLabel": "[if(contains(parameters('volumes')[copyIndex()], 'backupLabel'), createObject('value', parameters('volumes')[copyIndex()].backupLabel), createObject('value', ''))]",
-          "snapshotName": "[if(contains(parameters('volumes')[copyIndex()], 'snapshotName'), createObject('value', parameters('volumes')[copyIndex()].snapshotName), createObject('value', 'snapshot'))]",
-          "useExistingSnapshot": "[if(contains(parameters('volumes')[copyIndex()], 'useExistingSnapshot'), createObject('value', parameters('volumes')[copyIndex()].useExistingSnapshot), createObject('value', false()))]",
-          "volumeResourceId": "[if(contains(parameters('volumes')[copyIndex()], 'volumeResourceId'), createObject('value', parameters('volumes')[copyIndex()].volumeResourceId), createObject('value', ''))]"
+          "coolAccess": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'coolAccess'), false())]"
+          },
+          "coolAccessRetrievalPolicy": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'coolAccessRetrievalPolicy'), 'Default')]"
+          },
+          "coolnessPeriod": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'coolnessPeriod'), 0)]"
+          },
+          "encryptionKeySource": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'encryptionKeySource'), 'Microsoft.NetApp')]"
+          },
+          "keyVaultPrivateEndpointResourceId": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'keyVaultPrivateEndpointResourceId'), '')]"
+          },
+          "endpointType": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'endpointType'), '')]"
+          },
+          "remoteVolumeRegion": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'remoteVolumeRegion'), '')]"
+          },
+          "remoteVolumeResourceId": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'remoteVolumeResourceId'), '')]"
+          },
+          "replicationSchedule": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'replicationSchedule'), '')]"
+          },
+          "snapshotPolicyId": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotPolicyId'), '')]"
+          },
+          "snapshotPolicyName": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotPolicyName'), 'snapshotPolicy')]"
+          },
+          "snapshotPolicyLocation": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotPolicyLocation'), '')]"
+          },
+          "snapEnabled": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapEnabled'), false())]"
+          },
+          "dailyHour": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyHour'), 0)]"
+          },
+          "dailyMinute": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyMinute'), 0)]"
+          },
+          "dailySnapshotsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailySnapshotsToKeep'), 0)]"
+          },
+          "dailyUsedBytes": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyUsedBytes'), 0)]"
+          },
+          "hourlyMinute": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'hourlyMinute'), 0)]"
+          },
+          "hourlySnapshotsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'hourlySnapshotsToKeep'), 0)]"
+          },
+          "hourlyUsedBytes": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'hourlyUsedBytes'), 0)]"
+          },
+          "daysOfMonth": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'daysOfMonth'), '')]"
+          },
+          "monthlyHour": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyHour'), 0)]"
+          },
+          "monthlyMinute": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyMinute'), 0)]"
+          },
+          "monthlySnapshotsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlySnapshotsToKeep'), 0)]"
+          },
+          "monthlyUsedBytes": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyUsedBytes'), 0)]"
+          },
+          "weeklyDay": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyDay'), '')]"
+          },
+          "weeklyHour": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyHour'), 0)]"
+          },
+          "weeklyMinute": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyMinute'), 0)]"
+          },
+          "weeklySnapshotsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklySnapshotsToKeep'), 0)]"
+          },
+          "weeklyUsedBytes": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyUsedBytes'), 0)]"
+          },
+          "backupPolicyName": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupPolicyName'), 'backupPolicy')]"
+          },
+          "backupPolicyLocation": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupPolicyLocation'), '')]"
+          },
+          "dailyBackupsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyBackupsToKeep'), 0)]"
+          },
+          "backupEnabled": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupEnabled'), false())]"
+          },
+          "monthlyBackupsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyBackupsToKeep'), 0)]"
+          },
+          "weeklyBackupsToKeep": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyBackupsToKeep'), 0)]"
+          },
+          "backupVaultName": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupVaultName'), 'vault')]"
+          },
+          "backupVaultLocation": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupVaultLocation'), '')]"
+          },
+          "backupName": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupName'), 'backup')]"
+          },
+          "backupLabel": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupLabel'), '')]"
+          },
+          "snapshotName": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotName'), 'snapshot')]"
+          },
+          "useExistingSnapshot": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'useExistingSnapshot'), false())]"
+          },
+          "volumeResourceId": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'volumeResourceId'), '')]"
+          },
+          "volumeType": {
+            "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'volumeType'), '')]"
+          }
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -321,7 +441,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "1599719170493782479"
+              "templateHash": "6870432140728658293"
             },
             "name": "Azure NetApp Files Capacity Pool Volumes",
             "description": "This module deploys an Azure NetApp Files Capacity Pool Volume.",
@@ -434,6 +554,18 @@
                 "description": "Optional. determines the data retrieval behavior from the cool tier to standard storage based on the read pattern for cool access enabled volumes (Default/Never/Read)."
               }
             },
+            "encryptionKeySource": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The source of the encryption key."
+              }
+            },
+            "keyVaultPrivateEndpointResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The resource ID of the key vault private endpoint."
+              }
+            },
             "endpointType": {
               "type": "string",
               "metadata": {
@@ -535,12 +667,146 @@
                 "description": "Optional. The name of the snapshot."
               }
             },
+            "snapshotPolicyId": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. Snapshot Policy ResourceId."
+              }
+            },
+            "snapshotPolicyName": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The name of the snapshot policy."
+              }
+            },
+            "snapshotPolicyLocation": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. The location of the snapshot policy."
+              }
+            },
+            "dailyHour": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The daily snapshot hour."
+              }
+            },
+            "dailyMinute": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The daily snapshot minute."
+              }
+            },
+            "dailySnapshotsToKeep": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Daily snapshot count to keep."
+              }
+            },
+            "dailyUsedBytes": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Daily snapshot used bytes."
+              }
+            },
+            "hourlyMinute": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The hourly snapshot minute."
+              }
+            },
+            "hourlySnapshotsToKeep": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Hourly snapshot count to keep."
+              }
+            },
+            "hourlyUsedBytes": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Hourly snapshot used bytes."
+              }
+            },
+            "daysOfMonth": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The monthly snapshot day."
+              }
+            },
+            "monthlyHour": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The monthly snapshot hour."
+              }
+            },
+            "monthlyMinute": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The monthly snapshot minute."
+              }
+            },
+            "monthlySnapshotsToKeep": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Monthly snapshot count to keep."
+              }
+            },
+            "monthlyUsedBytes": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Monthly snapshot used bytes."
+              }
+            },
+            "weeklyDay": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The weekly snapshot day."
+              }
+            },
+            "weeklyHour": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The weekly snapshot hour."
+              }
+            },
+            "weeklyMinute": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. The weekly snapshot minute."
+              }
+            },
+            "weeklySnapshotsToKeep": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Weekly snapshot count to keep."
+              }
+            },
+            "weeklyUsedBytes": {
+              "type": "int",
+              "metadata": {
+                "description": "Optional. Weekly snapshot used bytes."
+              }
+            },
+            "snapEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Indicates whether the snapshot policy is enabled."
+              }
+            },
             "volumeResourceId": {
               "type": "string",
               "metadata": {
                 "description": "Optional. The resource ID of the volume."
               }
             },
+            "volumeType": {
+              "type": "string",
+              "metadata": {
+                "description": "Optional. The type of the volume. DataProtection volumes are used for replication."
+              }
+            },
             "name": {
               "type": "string",
               "metadata": {
@@ -649,7 +915,7 @@
             "netAppAccount::capacityPool": {
               "existing": true,
               "type": "Microsoft.NetApp/netAppAccounts/capacityPools",
-              "apiVersion": "2023-07-01",
+              "apiVersion": "2024-03-01",
               "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('capacityPoolName'))]",
               "dependsOn": [
                 "netAppAccount"
@@ -658,24 +924,62 @@
             "netAppAccount": {
               "existing": true,
               "type": "Microsoft.NetApp/netAppAccounts",
-              "apiVersion": "2023-07-01",
+              "apiVersion": "2024-03-01",
               "name": "[parameters('netAppAccountName')]"
             },
             "volume": {
               "type": "Microsoft.NetApp/netAppAccounts/capacityPools/volumes",
-              "apiVersion": "2023-07-01",
+              "apiVersion": "2024-03-01",
               "name": "[format('{0}/{1}/{2}', parameters('netAppAccountName'), parameters('capacityPoolName'), parameters('name'))]",
               "location": "[parameters('location')]",
-              "properties": "[shallowMerge(createArray(createObject('coolAccess', parameters('coolAccess'), 'coolAccessRetrievalPolicy', parameters('coolAccessRetrievalPolicy'), 'coolnessPeriod', parameters('coolnessPeriod')), if(not(equals(parameters('endpointType'), '')), createObject('dataProtection', createObject('replication', createObject('endpointType', parameters('endpointType'), 'remoteVolumeRegion', parameters('remoteVolumeRegion'), 'remoteVolumeResourceId', parameters('remoteVolumeResourceId'), 'replicationSchedule', parameters('replicationSchedule')))), createObject()), createObject('networkFeatures', parameters('networkFeatures'), 'serviceLevel', parameters('serviceLevel'), 'creationToken', parameters('creationToken'), 'usageThreshold', parameters('usageThreshold'), 'protocolTypes', parameters('protocolTypes'), 'subnetId', parameters('subnetResourceId'), 'exportPolicy', if(not(empty(parameters('exportPolicyRules'))), createObject('rules', parameters('exportPolicyRules')), null()))))]",
+              "properties": "[shallowMerge(createArray(createObject('coolAccess', parameters('coolAccess'), 'coolAccessRetrievalPolicy', parameters('coolAccessRetrievalPolicy'), 'coolnessPeriod', parameters('coolnessPeriod'), 'encryptionKeySource', parameters('encryptionKeySource')), if(not(equals(parameters('encryptionKeySource'), 'Microsoft.NetApp')), createObject('keyVaultPrivateEndpointResourceId', parameters('keyVaultPrivateEndpointResourceId')), createObject()), if(not(equals(parameters('volumeType'), '')), createObject('volumeType', parameters('volumeType'), 'dataProtection', createObject('replication', createObject('endpointType', parameters('endpointType'), 'remoteVolumeRegion', parameters('remoteVolumeRegion'), 'remoteVolumeResourceId', parameters('remoteVolumeResourceId'), 'replicationSchedule', parameters('replicationSchedule')), 'snapshot', createObject('snapshotPolicyId', parameters('snapshotPolicyId')))), createObject()), createObject('networkFeatures', parameters('networkFeatures'), 'serviceLevel', parameters('serviceLevel'), 'creationToken', parameters('creationToken'), 'usageThreshold', parameters('usageThreshold'), 'protocolTypes', parameters('protocolTypes'), 'subnetId', parameters('subnetResourceId'), 'exportPolicy', if(not(empty(parameters('exportPolicyRules'))), createObject('rules', parameters('exportPolicyRules')), null()))))]",
               "zones": "[parameters('zones')]",
               "dependsOn": [
                 "netAppAccount::capacityPool"
               ]
             },
+            "snapshotPolicies": {
+              "condition": "[parameters('snapEnabled')]",
+              "type": "Microsoft.NetApp/netAppAccounts/snapshotPolicies",
+              "apiVersion": "2024-03-01",
+              "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('snapshotPolicyName'))]",
+              "location": "[parameters('snapshotPolicyLocation')]",
+              "properties": {
+                "enabled": "[parameters('snapEnabled')]",
+                "dailySchedule": {
+                  "hour": "[parameters('dailyHour')]",
+                  "minute": "[parameters('dailyMinute')]",
+                  "snapshotsToKeep": "[parameters('dailySnapshotsToKeep')]",
+                  "usedBytes": "[parameters('dailyUsedBytes')]"
+                },
+                "hourlySchedule": {
+                  "minute": "[parameters('hourlyMinute')]",
+                  "snapshotsToKeep": "[parameters('hourlySnapshotsToKeep')]",
+                  "usedBytes": "[parameters('hourlyUsedBytes')]"
+                },
+                "monthlySchedule": {
+                  "daysOfMonth": "[parameters('daysOfMonth')]",
+                  "hour": "[parameters('monthlyHour')]",
+                  "minute": "[parameters('monthlyMinute')]",
+                  "snapshotsToKeep": "[parameters('monthlySnapshotsToKeep')]",
+                  "usedBytes": "[parameters('monthlyUsedBytes')]"
+                },
+                "weeklySchedule": {
+                  "day": "[parameters('weeklyDay')]",
+                  "hour": "[parameters('weeklyHour')]",
+                  "minute": "[parameters('weeklyMinute')]",
+                  "snapshotsToKeep": "[parameters('weeklySnapshotsToKeep')]",
+                  "usedBytes": "[parameters('weeklyUsedBytes')]"
+                }
+              },
+              "dependsOn": [
+                "netAppAccount"
+              ]
+            },
             "backupPolicies": {
               "condition": "[parameters('backupEnabled')]",
               "type": "Microsoft.NetApp/netAppAccounts/backupPolicies",
-              "apiVersion": "2023-11-01",
+              "apiVersion": "2024-03-01",
               "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('backupPolicyName'))]",
               "location": "[parameters('backupPolicyLocation')]",
               "properties": {
@@ -691,7 +995,7 @@
             "backupVaults": {
               "condition": "[parameters('backupEnabled')]",
               "type": "Microsoft.NetApp/netAppAccounts/backupVaults",
-              "apiVersion": "2023-05-01-preview",
+              "apiVersion": "2024-03-01",
               "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('backupVaultName'))]",
               "location": "[parameters('backupVaultLocation')]",
               "properties": {},
@@ -702,7 +1006,7 @@
             "backups": {
               "condition": "[parameters('backupEnabled')]",
               "type": "Microsoft.NetApp/netAppAccounts/backupVaults/backups",
-              "apiVersion": "2023-05-01-preview",
+              "apiVersion": "2024-03-01",
               "name": "[format('{0}/{1}/{2}', parameters('netAppAccountName'), parameters('backupVaultName'), parameters('backupName'))]",
               "properties": "[if(parameters('backupEnabled'), createObject('label', parameters('backupLabel'), 'snapshotName', parameters('snapshotName'), 'useExistingSnapshot', parameters('useExistingSnapshot'), 'volumeResourceId', parameters('volumeResourceId')), createObject())]",
               "dependsOn": [
@@ -759,7 +1063,7 @@
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('volume', '2023-07-01', 'full').location]"
+              "value": "[reference('volume', '2024-03-01', 'full').location]"
             }
           }
         }
@@ -797,7 +1101,7 @@
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('capacityPool', '2023-07-01', 'full').location]"
+      "value": "[reference('capacityPool', '2024-03-01', 'full').location]"
     },
     "volumeResourceId": {
       "type": "string",
diff --git a/avm/res/net-app/net-app-account/capacity-pool/volume/README.md b/avm/res/net-app/net-app-account/capacity-pool/volume/README.md
index b05f6538be..f7d5472e35 100644
--- a/avm/res/net-app/net-app-account/capacity-pool/volume/README.md
+++ b/avm/res/net-app/net-app-account/capacity-pool/volume/README.md
@@ -13,10 +13,11 @@ This module deploys an Azure NetApp Files Capacity Pool Volume.
 | Resource Type | API Version |
 | :-- | :-- |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
-| `Microsoft.NetApp/netAppAccounts/backupPolicies` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-11-01/netAppAccounts/backupPolicies) |
-| `Microsoft.NetApp/netAppAccounts/backupVaults` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-05-01-preview/netAppAccounts/backupVaults) |
-| `Microsoft.NetApp/netAppAccounts/backupVaults/backups` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-05-01-preview/netAppAccounts/backupVaults/backups) |
-| `Microsoft.NetApp/netAppAccounts/capacityPools/volumes` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2023-07-01/netAppAccounts/capacityPools/volumes) |
+| `Microsoft.NetApp/netAppAccounts/backupPolicies` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupPolicies) |
+| `Microsoft.NetApp/netAppAccounts/backupVaults` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupVaults) |
+| `Microsoft.NetApp/netAppAccounts/backupVaults/backups` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/backupVaults/backups) |
+| `Microsoft.NetApp/netAppAccounts/capacityPools/volumes` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/capacityPools/volumes) |
+| `Microsoft.NetApp/netAppAccounts/snapshotPolicies` | [2024-03-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.NetApp/2024-03-01/netAppAccounts/snapshotPolicies) |
 
 ## Parameters
 
@@ -51,10 +52,24 @@ This module deploys an Azure NetApp Files Capacity Pool Volume.
 | [`coolnessPeriod`](#parameter-coolnessperiod) | int | Specifies the number of days after which data that is not accessed by clients will be tiered. |
 | [`creationToken`](#parameter-creationtoken) | string | A unique file path for the volume. This is the name of the volume export. A volume is mounted using the export path. File path must start with an alphabetical character and be unique within the subscription. |
 | [`dailyBackupsToKeep`](#parameter-dailybackupstokeep) | int | The daily backups to keep. |
+| [`dailyHour`](#parameter-dailyhour) | int | The daily snapshot hour. |
+| [`dailyMinute`](#parameter-dailyminute) | int | The daily snapshot minute. |
+| [`dailySnapshotsToKeep`](#parameter-dailysnapshotstokeep) | int | Daily snapshot count to keep. |
+| [`dailyUsedBytes`](#parameter-dailyusedbytes) | int | Daily snapshot used bytes. |
+| [`daysOfMonth`](#parameter-daysofmonth) | string | The monthly snapshot day. |
+| [`encryptionKeySource`](#parameter-encryptionkeysource) | string | The source of the encryption key. |
 | [`endpointType`](#parameter-endpointtype) | string | Indicates whether the local volume is the source or destination for the Volume Replication (src/dst). |
 | [`exportPolicyRules`](#parameter-exportpolicyrules) | array | Export policy rules. |
+| [`hourlyMinute`](#parameter-hourlyminute) | int | The hourly snapshot minute. |
+| [`hourlySnapshotsToKeep`](#parameter-hourlysnapshotstokeep) | int | Hourly snapshot count to keep. |
+| [`hourlyUsedBytes`](#parameter-hourlyusedbytes) | int | Hourly snapshot used bytes. |
+| [`keyVaultPrivateEndpointResourceId`](#parameter-keyvaultprivateendpointresourceid) | string | The resource ID of the key vault private endpoint. |
 | [`location`](#parameter-location) | string | Location of the pool volume. |
 | [`monthlyBackupsToKeep`](#parameter-monthlybackupstokeep) | int | The monthly backups to keep. |
+| [`monthlyHour`](#parameter-monthlyhour) | int | The monthly snapshot hour. |
+| [`monthlyMinute`](#parameter-monthlyminute) | int | The monthly snapshot minute. |
+| [`monthlySnapshotsToKeep`](#parameter-monthlysnapshotstokeep) | int | Monthly snapshot count to keep. |
+| [`monthlyUsedBytes`](#parameter-monthlyusedbytes) | int | Monthly snapshot used bytes. |
 | [`networkFeatures`](#parameter-networkfeatures) | string | Network feature for the volume. |
 | [`protocolTypes`](#parameter-protocoltypes) | array | Set of protocol types. |
 | [`remoteVolumeRegion`](#parameter-remotevolumeregion) | string | The remote region for the other end of the Volume Replication. |
@@ -62,10 +77,20 @@ This module deploys an Azure NetApp Files Capacity Pool Volume.
 | [`replicationSchedule`](#parameter-replicationschedule) | string | The replication schedule for the volume. |
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
 | [`serviceLevel`](#parameter-servicelevel) | string | The pool service level. Must match the one of the parent capacity pool. |
+| [`snapEnabled`](#parameter-snapenabled) | bool | Indicates whether the snapshot policy is enabled. |
 | [`snapshotName`](#parameter-snapshotname) | string | The name of the snapshot. |
+| [`snapshotPolicyId`](#parameter-snapshotpolicyid) | string | Snapshot Policy ResourceId. |
+| [`snapshotPolicyLocation`](#parameter-snapshotpolicylocation) | string | The location of the snapshot policy. |
+| [`snapshotPolicyName`](#parameter-snapshotpolicyname) | string | The name of the snapshot policy. |
 | [`useExistingSnapshot`](#parameter-useexistingsnapshot) | bool | Indicates whether to use an existing snapshot. |
 | [`volumeResourceId`](#parameter-volumeresourceid) | string | The resource ID of the volume. |
+| [`volumeType`](#parameter-volumetype) | string | The type of the volume. DataProtection volumes are used for replication. |
 | [`weeklyBackupsToKeep`](#parameter-weeklybackupstokeep) | int | The weekly backups to keep. |
+| [`weeklyDay`](#parameter-weeklyday) | string | The weekly snapshot day. |
+| [`weeklyHour`](#parameter-weeklyhour) | int | The weekly snapshot hour. |
+| [`weeklyMinute`](#parameter-weeklyminute) | int | The weekly snapshot minute. |
+| [`weeklySnapshotsToKeep`](#parameter-weeklysnapshotstokeep) | int | Weekly snapshot count to keep. |
+| [`weeklyUsedBytes`](#parameter-weeklyusedbytes) | int | Weekly snapshot used bytes. |
 | [`zones`](#parameter-zones) | array | Zone where the volume will be placed. |
 
 ### Parameter: `name`
@@ -194,6 +219,48 @@ The daily backups to keep.
 - Required: Yes
 - Type: int
 
+### Parameter: `dailyHour`
+
+The daily snapshot hour.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `dailyMinute`
+
+The daily snapshot minute.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `dailySnapshotsToKeep`
+
+Daily snapshot count to keep.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `dailyUsedBytes`
+
+Daily snapshot used bytes.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `daysOfMonth`
+
+The monthly snapshot day.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `encryptionKeySource`
+
+The source of the encryption key.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `endpointType`
 
 Indicates whether the local volume is the source or destination for the Volume Replication (src/dst).
@@ -209,6 +276,34 @@ Export policy rules.
 - Type: array
 - Default: `[]`
 
+### Parameter: `hourlyMinute`
+
+The hourly snapshot minute.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `hourlySnapshotsToKeep`
+
+Hourly snapshot count to keep.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `hourlyUsedBytes`
+
+Hourly snapshot used bytes.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `keyVaultPrivateEndpointResourceId`
+
+The resource ID of the key vault private endpoint.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `location`
 
 Location of the pool volume.
@@ -224,6 +319,34 @@ The monthly backups to keep.
 - Required: Yes
 - Type: int
 
+### Parameter: `monthlyHour`
+
+The monthly snapshot hour.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `monthlyMinute`
+
+The monthly snapshot minute.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `monthlySnapshotsToKeep`
+
+Monthly snapshot count to keep.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `monthlyUsedBytes`
+
+Monthly snapshot used bytes.
+
+- Required: Yes
+- Type: int
+
 ### Parameter: `networkFeatures`
 
 Network feature for the volume.
@@ -384,6 +507,14 @@ The pool service level. Must match the one of the parent capacity pool.
   ]
   ```
 
+### Parameter: `snapEnabled`
+
+Indicates whether the snapshot policy is enabled.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
 ### Parameter: `snapshotName`
 
 The name of the snapshot.
@@ -391,6 +522,28 @@ The name of the snapshot.
 - Required: Yes
 - Type: string
 
+### Parameter: `snapshotPolicyId`
+
+Snapshot Policy ResourceId.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `snapshotPolicyLocation`
+
+The location of the snapshot policy.
+
+- Required: No
+- Type: string
+- Default: `[resourceGroup().location]`
+
+### Parameter: `snapshotPolicyName`
+
+The name of the snapshot policy.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `useExistingSnapshot`
 
 Indicates whether to use an existing snapshot.
@@ -405,6 +558,13 @@ The resource ID of the volume.
 - Required: Yes
 - Type: string
 
+### Parameter: `volumeType`
+
+The type of the volume. DataProtection volumes are used for replication.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `weeklyBackupsToKeep`
 
 The weekly backups to keep.
@@ -412,6 +572,41 @@ The weekly backups to keep.
 - Required: Yes
 - Type: int
 
+### Parameter: `weeklyDay`
+
+The weekly snapshot day.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `weeklyHour`
+
+The weekly snapshot hour.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `weeklyMinute`
+
+The weekly snapshot minute.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `weeklySnapshotsToKeep`
+
+Weekly snapshot count to keep.
+
+- Required: Yes
+- Type: int
+
+### Parameter: `weeklyUsedBytes`
+
+Weekly snapshot used bytes.
+
+- Required: Yes
+- Type: int
+
 ### Parameter: `zones`
 
 Zone where the volume will be placed.
diff --git a/avm/res/net-app/net-app-account/capacity-pool/volume/main.bicep b/avm/res/net-app/net-app-account/capacity-pool/volume/main.bicep
index 41edd755c8..b9b26d20bf 100644
--- a/avm/res/net-app/net-app-account/capacity-pool/volume/main.bicep
+++ b/avm/res/net-app/net-app-account/capacity-pool/volume/main.bicep
@@ -17,6 +17,12 @@ param coolnessPeriod int
 @description('Optional. determines the data retrieval behavior from the cool tier to standard storage based on the read pattern for cool access enabled volumes (Default/Never/Read).')
 param coolAccessRetrievalPolicy string = 'Default'
 
+@description('Optional. The source of the encryption key.')
+param encryptionKeySource string
+
+@description('Optional. The resource ID of the key vault private endpoint.')
+param keyVaultPrivateEndpointResourceId string
+
 @description('Optional. Indicates whether the local volume is the source or destination for the Volume Replication (src/dst).')
 param endpointType string
 
@@ -65,9 +71,75 @@ param useExistingSnapshot bool
 @description('Optional. The name of the snapshot.')
 param snapshotName string
 
+@description('Optional. Snapshot Policy ResourceId.')
+param snapshotPolicyId string
+
+@description('Optional. The name of the snapshot policy.')
+param snapshotPolicyName string
+
+@description('Optional. The location of the snapshot policy.')
+param snapshotPolicyLocation string = resourceGroup().location
+
+@description('Optional. The daily snapshot hour.')
+param dailyHour int
+
+@description('Optional. The daily snapshot minute.')
+param dailyMinute int
+
+@description('Optional. Daily snapshot count to keep.')
+param dailySnapshotsToKeep int
+
+@description('Optional. Daily snapshot used bytes.')
+param dailyUsedBytes int
+
+@description('Optional. The hourly snapshot minute.')
+param hourlyMinute int
+
+@description('Optional. Hourly snapshot count to keep.')
+param hourlySnapshotsToKeep int
+
+@description('Optional. Hourly snapshot used bytes.')
+param hourlyUsedBytes int
+
+@description('Optional. The monthly snapshot day.')
+param daysOfMonth string
+
+@description('Optional. The monthly snapshot hour.')
+param monthlyHour int
+
+@description('Optional. The monthly snapshot minute.')
+param monthlyMinute int
+
+@description('Optional. Monthly snapshot count to keep.')
+param monthlySnapshotsToKeep int
+
+@description('Optional. Monthly snapshot used bytes.')
+param monthlyUsedBytes int
+
+@description('Optional. The weekly snapshot day.')
+param weeklyDay string
+
+@description('Optional. The weekly snapshot hour.')
+param weeklyHour int
+
+@description('Optional. The weekly snapshot minute.')
+param weeklyMinute int
+
+@description('Optional. Weekly snapshot count to keep.')
+param weeklySnapshotsToKeep int
+
+@description('Optional. Weekly snapshot used bytes.')
+param weeklyUsedBytes int
+
+@description('Optional. Indicates whether the snapshot policy is enabled.')
+param snapEnabled bool = false
+
 @description('Optional. The resource ID of the volume.')
 param volumeResourceId string
 
+@description('Optional. The type of the volume. DataProtection volumes are used for replication.')
+param volumeType string
+
 @description('Required. The name of the pool volume.')
 param name string
 
@@ -138,15 +210,15 @@ var formattedRoleAssignments = [
   })
 ]
 
-resource netAppAccount 'Microsoft.NetApp/netAppAccounts@2023-07-01' existing = {
+resource netAppAccount 'Microsoft.NetApp/netAppAccounts@2024-03-01' existing = {
   name: netAppAccountName
 
-  resource capacityPool 'capacityPools@2023-07-01' existing = {
+  resource capacityPool 'capacityPools@2024-03-01' existing = {
     name: capacityPoolName
   }
 }
 
-resource volume 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes@2023-07-01' = {
+resource volume 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes@2024-03-01' = {
   name: name
   parent: netAppAccount::capacityPool
   location: location
@@ -154,8 +226,15 @@ resource volume 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes@2023-07-0
     coolAccess: coolAccess
     coolAccessRetrievalPolicy: coolAccessRetrievalPolicy
     coolnessPeriod: coolnessPeriod
-    ...(endpointType != ''
+    encryptionKeySource: encryptionKeySource
+    ...(encryptionKeySource != 'Microsoft.NetApp'
       ? {
+          keyVaultPrivateEndpointResourceId: keyVaultPrivateEndpointResourceId
+        }
+      : {})
+    ...(volumeType != ''
+      ? {
+          volumeType: volumeType
           dataProtection: {
             replication: {
               endpointType: endpointType
@@ -163,6 +242,9 @@ resource volume 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes@2023-07-0
               remoteVolumeResourceId: remoteVolumeResourceId
               replicationSchedule: replicationSchedule
             }
+            snapshot: {
+              snapshotPolicyId: snapshotPolicyId
+            }
           }
         }
       : {})
@@ -181,7 +263,41 @@ resource volume 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes@2023-07-0
   zones: zones
 }
 
-resource backupPolicies 'Microsoft.NetApp/netAppAccounts/backupPolicies@2023-11-01' = if (backupEnabled) {
+resource snapshotPolicies 'Microsoft.NetApp/netAppAccounts/snapshotPolicies@2024-03-01' = if (snapEnabled) {
+  name: snapshotPolicyName
+  parent: netAppAccount
+  location: snapshotPolicyLocation
+  properties: {
+    enabled: snapEnabled
+    dailySchedule: {
+      hour: dailyHour
+      minute: dailyMinute
+      snapshotsToKeep: dailySnapshotsToKeep
+      usedBytes: dailyUsedBytes
+    }
+    hourlySchedule: {
+      minute: hourlyMinute
+      snapshotsToKeep: hourlySnapshotsToKeep
+      usedBytes: hourlyUsedBytes
+    }
+    monthlySchedule: {
+      daysOfMonth: daysOfMonth
+      hour: monthlyHour
+      minute: monthlyMinute
+      snapshotsToKeep: monthlySnapshotsToKeep
+      usedBytes: monthlyUsedBytes
+    }
+    weeklySchedule: {
+      day: weeklyDay
+      hour: weeklyHour
+      minute: weeklyMinute
+      snapshotsToKeep: weeklySnapshotsToKeep
+      usedBytes: weeklyUsedBytes
+    }
+  }
+}
+
+resource backupPolicies 'Microsoft.NetApp/netAppAccounts/backupPolicies@2024-03-01' = if (backupEnabled) {
   name: backupPolicyName
   parent: netAppAccount
   location: backupPolicyLocation
@@ -193,14 +309,14 @@ resource backupPolicies 'Microsoft.NetApp/netAppAccounts/backupPolicies@2023-11-
   }
 }
 
-resource backupVaults 'Microsoft.NetApp/netAppAccounts/backupVaults@2023-05-01-preview' = if (backupEnabled) {
+resource backupVaults 'Microsoft.NetApp/netAppAccounts/backupVaults@2024-03-01' = if (backupEnabled) {
   name: backupVaultName
   parent: netAppAccount
   location: backupVaultLocation
   properties: {}
 }
 
-resource backups 'Microsoft.NetApp/netAppAccounts/backupVaults/backups@2023-05-01-preview' = if (backupEnabled) {
+resource backups 'Microsoft.NetApp/netAppAccounts/backupVaults/backups@2024-03-01' = if (backupEnabled) {
   name: backupName
   parent: backupVaults
   properties: backupEnabled
diff --git a/avm/res/net-app/net-app-account/capacity-pool/volume/main.json b/avm/res/net-app/net-app-account/capacity-pool/volume/main.json
index 0954623999..968ee1993c 100644
--- a/avm/res/net-app/net-app-account/capacity-pool/volume/main.json
+++ b/avm/res/net-app/net-app-account/capacity-pool/volume/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "1599719170493782479"
+      "templateHash": "6870432140728658293"
     },
     "name": "Azure NetApp Files Capacity Pool Volumes",
     "description": "This module deploys an Azure NetApp Files Capacity Pool Volume.",
@@ -119,6 +119,18 @@
         "description": "Optional. determines the data retrieval behavior from the cool tier to standard storage based on the read pattern for cool access enabled volumes (Default/Never/Read)."
       }
     },
+    "encryptionKeySource": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. The source of the encryption key."
+      }
+    },
+    "keyVaultPrivateEndpointResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. The resource ID of the key vault private endpoint."
+      }
+    },
     "endpointType": {
       "type": "string",
       "metadata": {
@@ -220,12 +232,146 @@
         "description": "Optional. The name of the snapshot."
       }
     },
+    "snapshotPolicyId": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. Snapshot Policy ResourceId."
+      }
+    },
+    "snapshotPolicyName": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. The name of the snapshot policy."
+      }
+    },
+    "snapshotPolicyLocation": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Optional. The location of the snapshot policy."
+      }
+    },
+    "dailyHour": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The daily snapshot hour."
+      }
+    },
+    "dailyMinute": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The daily snapshot minute."
+      }
+    },
+    "dailySnapshotsToKeep": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Daily snapshot count to keep."
+      }
+    },
+    "dailyUsedBytes": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Daily snapshot used bytes."
+      }
+    },
+    "hourlyMinute": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The hourly snapshot minute."
+      }
+    },
+    "hourlySnapshotsToKeep": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Hourly snapshot count to keep."
+      }
+    },
+    "hourlyUsedBytes": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Hourly snapshot used bytes."
+      }
+    },
+    "daysOfMonth": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. The monthly snapshot day."
+      }
+    },
+    "monthlyHour": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The monthly snapshot hour."
+      }
+    },
+    "monthlyMinute": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The monthly snapshot minute."
+      }
+    },
+    "monthlySnapshotsToKeep": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Monthly snapshot count to keep."
+      }
+    },
+    "monthlyUsedBytes": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Monthly snapshot used bytes."
+      }
+    },
+    "weeklyDay": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. The weekly snapshot day."
+      }
+    },
+    "weeklyHour": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The weekly snapshot hour."
+      }
+    },
+    "weeklyMinute": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. The weekly snapshot minute."
+      }
+    },
+    "weeklySnapshotsToKeep": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Weekly snapshot count to keep."
+      }
+    },
+    "weeklyUsedBytes": {
+      "type": "int",
+      "metadata": {
+        "description": "Optional. Weekly snapshot used bytes."
+      }
+    },
+    "snapEnabled": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Indicates whether the snapshot policy is enabled."
+      }
+    },
     "volumeResourceId": {
       "type": "string",
       "metadata": {
         "description": "Optional. The resource ID of the volume."
       }
     },
+    "volumeType": {
+      "type": "string",
+      "metadata": {
+        "description": "Optional. The type of the volume. DataProtection volumes are used for replication."
+      }
+    },
     "name": {
       "type": "string",
       "metadata": {
@@ -334,7 +480,7 @@
     "netAppAccount::capacityPool": {
       "existing": true,
       "type": "Microsoft.NetApp/netAppAccounts/capacityPools",
-      "apiVersion": "2023-07-01",
+      "apiVersion": "2024-03-01",
       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('capacityPoolName'))]",
       "dependsOn": [
         "netAppAccount"
@@ -343,24 +489,62 @@
     "netAppAccount": {
       "existing": true,
       "type": "Microsoft.NetApp/netAppAccounts",
-      "apiVersion": "2023-07-01",
+      "apiVersion": "2024-03-01",
       "name": "[parameters('netAppAccountName')]"
     },
     "volume": {
       "type": "Microsoft.NetApp/netAppAccounts/capacityPools/volumes",
-      "apiVersion": "2023-07-01",
+      "apiVersion": "2024-03-01",
       "name": "[format('{0}/{1}/{2}', parameters('netAppAccountName'), parameters('capacityPoolName'), parameters('name'))]",
       "location": "[parameters('location')]",
-      "properties": "[shallowMerge(createArray(createObject('coolAccess', parameters('coolAccess'), 'coolAccessRetrievalPolicy', parameters('coolAccessRetrievalPolicy'), 'coolnessPeriod', parameters('coolnessPeriod')), if(not(equals(parameters('endpointType'), '')), createObject('dataProtection', createObject('replication', createObject('endpointType', parameters('endpointType'), 'remoteVolumeRegion', parameters('remoteVolumeRegion'), 'remoteVolumeResourceId', parameters('remoteVolumeResourceId'), 'replicationSchedule', parameters('replicationSchedule')))), createObject()), createObject('networkFeatures', parameters('networkFeatures'), 'serviceLevel', parameters('serviceLevel'), 'creationToken', parameters('creationToken'), 'usageThreshold', parameters('usageThreshold'), 'protocolTypes', parameters('protocolTypes'), 'subnetId', parameters('subnetResourceId'), 'exportPolicy', if(not(empty(parameters('exportPolicyRules'))), createObject('rules', parameters('exportPolicyRules')), null()))))]",
+      "properties": "[shallowMerge(createArray(createObject('coolAccess', parameters('coolAccess'), 'coolAccessRetrievalPolicy', parameters('coolAccessRetrievalPolicy'), 'coolnessPeriod', parameters('coolnessPeriod'), 'encryptionKeySource', parameters('encryptionKeySource')), if(not(equals(parameters('encryptionKeySource'), 'Microsoft.NetApp')), createObject('keyVaultPrivateEndpointResourceId', parameters('keyVaultPrivateEndpointResourceId')), createObject()), if(not(equals(parameters('volumeType'), '')), createObject('volumeType', parameters('volumeType'), 'dataProtection', createObject('replication', createObject('endpointType', parameters('endpointType'), 'remoteVolumeRegion', parameters('remoteVolumeRegion'), 'remoteVolumeResourceId', parameters('remoteVolumeResourceId'), 'replicationSchedule', parameters('replicationSchedule')), 'snapshot', createObject('snapshotPolicyId', parameters('snapshotPolicyId')))), createObject()), createObject('networkFeatures', parameters('networkFeatures'), 'serviceLevel', parameters('serviceLevel'), 'creationToken', parameters('creationToken'), 'usageThreshold', parameters('usageThreshold'), 'protocolTypes', parameters('protocolTypes'), 'subnetId', parameters('subnetResourceId'), 'exportPolicy', if(not(empty(parameters('exportPolicyRules'))), createObject('rules', parameters('exportPolicyRules')), null()))))]",
       "zones": "[parameters('zones')]",
       "dependsOn": [
         "netAppAccount::capacityPool"
       ]
     },
+    "snapshotPolicies": {
+      "condition": "[parameters('snapEnabled')]",
+      "type": "Microsoft.NetApp/netAppAccounts/snapshotPolicies",
+      "apiVersion": "2024-03-01",
+      "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('snapshotPolicyName'))]",
+      "location": "[parameters('snapshotPolicyLocation')]",
+      "properties": {
+        "enabled": "[parameters('snapEnabled')]",
+        "dailySchedule": {
+          "hour": "[parameters('dailyHour')]",
+          "minute": "[parameters('dailyMinute')]",
+          "snapshotsToKeep": "[parameters('dailySnapshotsToKeep')]",
+          "usedBytes": "[parameters('dailyUsedBytes')]"
+        },
+        "hourlySchedule": {
+          "minute": "[parameters('hourlyMinute')]",
+          "snapshotsToKeep": "[parameters('hourlySnapshotsToKeep')]",
+          "usedBytes": "[parameters('hourlyUsedBytes')]"
+        },
+        "monthlySchedule": {
+          "daysOfMonth": "[parameters('daysOfMonth')]",
+          "hour": "[parameters('monthlyHour')]",
+          "minute": "[parameters('monthlyMinute')]",
+          "snapshotsToKeep": "[parameters('monthlySnapshotsToKeep')]",
+          "usedBytes": "[parameters('monthlyUsedBytes')]"
+        },
+        "weeklySchedule": {
+          "day": "[parameters('weeklyDay')]",
+          "hour": "[parameters('weeklyHour')]",
+          "minute": "[parameters('weeklyMinute')]",
+          "snapshotsToKeep": "[parameters('weeklySnapshotsToKeep')]",
+          "usedBytes": "[parameters('weeklyUsedBytes')]"
+        }
+      },
+      "dependsOn": [
+        "netAppAccount"
+      ]
+    },
     "backupPolicies": {
       "condition": "[parameters('backupEnabled')]",
       "type": "Microsoft.NetApp/netAppAccounts/backupPolicies",
-      "apiVersion": "2023-11-01",
+      "apiVersion": "2024-03-01",
       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('backupPolicyName'))]",
       "location": "[parameters('backupPolicyLocation')]",
       "properties": {
@@ -376,7 +560,7 @@
     "backupVaults": {
       "condition": "[parameters('backupEnabled')]",
       "type": "Microsoft.NetApp/netAppAccounts/backupVaults",
-      "apiVersion": "2023-05-01-preview",
+      "apiVersion": "2024-03-01",
       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('backupVaultName'))]",
       "location": "[parameters('backupVaultLocation')]",
       "properties": {},
@@ -387,7 +571,7 @@
     "backups": {
       "condition": "[parameters('backupEnabled')]",
       "type": "Microsoft.NetApp/netAppAccounts/backupVaults/backups",
-      "apiVersion": "2023-05-01-preview",
+      "apiVersion": "2024-03-01",
       "name": "[format('{0}/{1}/{2}', parameters('netAppAccountName'), parameters('backupVaultName'), parameters('backupName'))]",
       "properties": "[if(parameters('backupEnabled'), createObject('label', parameters('backupLabel'), 'snapshotName', parameters('snapshotName'), 'useExistingSnapshot', parameters('useExistingSnapshot'), 'volumeResourceId', parameters('volumeResourceId')), createObject())]",
       "dependsOn": [
@@ -444,7 +628,7 @@
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('volume', '2023-07-01', 'full').location]"
+      "value": "[reference('volume', '2024-03-01', 'full').location]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/net-app/net-app-account/main.bicep b/avm/res/net-app/net-app-account/main.bicep
index 2fcc14dd69..4f00ec4c93 100644
--- a/avm/res/net-app/net-app-account/main.bicep
+++ b/avm/res/net-app/net-app-account/main.bicep
@@ -124,8 +124,8 @@ var formattedRoleAssignments = [
       : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName))
   })
 ]
-
 #disable-next-line no-deployments-resources
+
 resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) {
   name: '46d3xbcp.res.netapp-netappaccount.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
   properties: {
@@ -164,7 +164,7 @@ resource cMKUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentiti
   )
 }
 
-resource netAppAccount 'Microsoft.NetApp/netAppAccounts@2023-07-01' = {
+resource netAppAccount 'Microsoft.NetApp/netAppAccounts@2024-03-01' = {
   name: name
   tags: tags
   identity: identity
@@ -224,12 +224,12 @@ module netAppAccount_capacityPools 'capacity-pool/main.bicep' = [
       name: capacityPool.name
       location: location
       size: capacityPool.size
-      serviceLevel: contains(capacityPool, 'serviceLevel') ? capacityPool.serviceLevel : 'Standard'
-      qosType: contains(capacityPool, 'qosType') ? capacityPool.qosType : 'Auto'
-      volumes: contains(capacityPool, 'volumes') ? capacityPool.volumes : []
-      coolAccess: contains(capacityPool, 'coolAccess') ? capacityPool.coolAccess : false
-      roleAssignments: contains(capacityPool, 'roleAssignments') ? capacityPool.roleAssignments : []
-      encryptionType: contains(capacityPool, 'encryptionType') ? capacityPool.encryptionType : 'Single'
+      serviceLevel: capacityPool.?serviceLevel ?? 'Standard'
+      qosType: capacityPool.?qosType ?? 'Auto'
+      volumes: capacityPool.?volumes ?? []
+      coolAccess: capacityPool.?coolAccess ?? false
+      roleAssignments: capacityPool.?roleAssignments ?? []
+      encryptionType: capacityPool.?encryptionType ?? 'Single'
       tags: capacityPool.?tags ?? tags
     }
   }
diff --git a/avm/res/net-app/net-app-account/main.json b/avm/res/net-app/net-app-account/main.json
index e171952137..73c191fcbd 100644
--- a/avm/res/net-app/net-app-account/main.json
+++ b/avm/res/net-app/net-app-account/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "5987985858923473876"
+      "templateHash": "4309703310956110255"
     },
     "name": "Azure NetApp Files",
     "description": "This module deploys an Azure NetApp File.",
@@ -398,7 +398,7 @@
     },
     "netAppAccount": {
       "type": "Microsoft.NetApp/netAppAccounts",
-      "apiVersion": "2023-07-01",
+      "apiVersion": "2024-03-01",
       "name": "[parameters('name')]",
       "tags": "[parameters('tags')]",
       "identity": "[variables('identity')]",
@@ -474,12 +474,24 @@
           "size": {
             "value": "[parameters('capacityPools')[copyIndex()].size]"
           },
-          "serviceLevel": "[if(contains(parameters('capacityPools')[copyIndex()], 'serviceLevel'), createObject('value', parameters('capacityPools')[copyIndex()].serviceLevel), createObject('value', 'Standard'))]",
-          "qosType": "[if(contains(parameters('capacityPools')[copyIndex()], 'qosType'), createObject('value', parameters('capacityPools')[copyIndex()].qosType), createObject('value', 'Auto'))]",
-          "volumes": "[if(contains(parameters('capacityPools')[copyIndex()], 'volumes'), createObject('value', parameters('capacityPools')[copyIndex()].volumes), createObject('value', createArray()))]",
-          "coolAccess": "[if(contains(parameters('capacityPools')[copyIndex()], 'coolAccess'), createObject('value', parameters('capacityPools')[copyIndex()].coolAccess), createObject('value', false()))]",
-          "roleAssignments": "[if(contains(parameters('capacityPools')[copyIndex()], 'roleAssignments'), createObject('value', parameters('capacityPools')[copyIndex()].roleAssignments), createObject('value', createArray()))]",
-          "encryptionType": "[if(contains(parameters('capacityPools')[copyIndex()], 'encryptionType'), createObject('value', parameters('capacityPools')[copyIndex()].encryptionType), createObject('value', 'Single'))]",
+          "serviceLevel": {
+            "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'serviceLevel'), 'Standard')]"
+          },
+          "qosType": {
+            "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'qosType'), 'Auto')]"
+          },
+          "volumes": {
+            "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'volumes'), createArray())]"
+          },
+          "coolAccess": {
+            "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'coolAccess'), false())]"
+          },
+          "roleAssignments": {
+            "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'roleAssignments'), createArray())]"
+          },
+          "encryptionType": {
+            "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'encryptionType'), 'Single')]"
+          },
           "tags": {
             "value": "[coalesce(tryGet(parameters('capacityPools')[copyIndex()], 'tags'), parameters('tags'))]"
           }
@@ -492,7 +504,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "2003436184027921318"
+              "templateHash": "2991493712029822030"
             },
             "name": "Azure NetApp Files Capacity Pools",
             "description": "This module deploys an Azure NetApp Files Capacity Pool.",
@@ -689,12 +701,12 @@
             "netAppAccount": {
               "existing": true,
               "type": "Microsoft.NetApp/netAppAccounts",
-              "apiVersion": "2023-07-01",
+              "apiVersion": "2024-03-01",
               "name": "[parameters('netAppAccountName')]"
             },
             "capacityPool": {
               "type": "Microsoft.NetApp/netAppAccounts/capacityPools",
-              "apiVersion": "2023-07-01",
+              "apiVersion": "2024-03-01",
               "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('name'))]",
               "location": "[parameters('location')]",
               "tags": "[parameters('tags')]",
@@ -762,42 +774,162 @@
                   "serviceLevel": {
                     "value": "[parameters('serviceLevel')]"
                   },
-                  "creationToken": "[if(contains(parameters('volumes')[copyIndex()], 'creationToken'), createObject('value', parameters('volumes')[copyIndex()].creationToken), createObject('value', parameters('volumes')[copyIndex()].name))]",
+                  "creationToken": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'creationToken'), parameters('volumes')[copyIndex()].name)]"
+                  },
                   "usageThreshold": {
                     "value": "[parameters('volumes')[copyIndex()].usageThreshold]"
                   },
-                  "protocolTypes": "[if(contains(parameters('volumes')[copyIndex()], 'protocolTypes'), createObject('value', parameters('volumes')[copyIndex()].protocolTypes), createObject('value', createArray()))]",
+                  "protocolTypes": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'protocolTypes'), createArray())]"
+                  },
                   "subnetResourceId": {
                     "value": "[parameters('volumes')[copyIndex()].subnetResourceId]"
                   },
-                  "exportPolicyRules": "[if(contains(parameters('volumes')[copyIndex()], 'exportPolicyRules'), createObject('value', parameters('volumes')[copyIndex()].exportPolicyRules), createObject('value', createArray()))]",
-                  "roleAssignments": "[if(contains(parameters('volumes')[copyIndex()], 'roleAssignments'), createObject('value', parameters('volumes')[copyIndex()].roleAssignments), createObject('value', createArray()))]",
+                  "exportPolicyRules": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'exportPolicyRules'), createArray())]"
+                  },
+                  "roleAssignments": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'roleAssignments'), createArray())]"
+                  },
                   "networkFeatures": {
                     "value": "[tryGet(parameters('volumes')[copyIndex()], 'networkFeatures')]"
                   },
                   "zones": {
                     "value": "[tryGet(parameters('volumes')[copyIndex()], 'zones')]"
                   },
-                  "coolAccess": "[if(contains(parameters('volumes')[copyIndex()], 'coolAccess'), createObject('value', parameters('volumes')[copyIndex()].coolAccess), createObject('value', false()))]",
-                  "coolAccessRetrievalPolicy": "[if(contains(parameters('volumes')[copyIndex()], 'coolAccessRetrievalPolicy'), createObject('value', parameters('volumes')[copyIndex()].coolAccessRetrievalPolicy), createObject('value', 'Default'))]",
-                  "coolnessPeriod": "[if(contains(parameters('volumes')[copyIndex()], 'coolnessPeriod'), createObject('value', parameters('volumes')[copyIndex()].coolnessPeriod), createObject('value', 0))]",
-                  "endpointType": "[if(contains(parameters('volumes')[copyIndex()], 'endpointType'), createObject('value', parameters('volumes')[copyIndex()].endpointType), createObject('value', ''))]",
-                  "remoteVolumeRegion": "[if(contains(parameters('volumes')[copyIndex()], 'remoteVolumeRegion'), createObject('value', parameters('volumes')[copyIndex()].remoteVolumeRegion), createObject('value', ''))]",
-                  "remoteVolumeResourceId": "[if(contains(parameters('volumes')[copyIndex()], 'remoteVolumeResourceId'), createObject('value', parameters('volumes')[copyIndex()].remoteVolumeResourceId), createObject('value', ''))]",
-                  "replicationSchedule": "[if(contains(parameters('volumes')[copyIndex()], 'replicationSchedule'), createObject('value', parameters('volumes')[copyIndex()].replicationSchedule), createObject('value', ''))]",
-                  "backupPolicyName": "[if(contains(parameters('volumes')[copyIndex()], 'backupPolicyName'), createObject('value', parameters('volumes')[copyIndex()].backupPolicyName), createObject('value', 'backupPolicy'))]",
-                  "backupPolicyLocation": "[if(contains(parameters('volumes')[copyIndex()], 'backupPolicyLocation'), createObject('value', parameters('volumes')[copyIndex()].backupPolicyLocation), createObject('value', ''))]",
-                  "dailyBackupsToKeep": "[if(contains(parameters('volumes')[copyIndex()], 'dailyBackupsToKeep'), createObject('value', parameters('volumes')[copyIndex()].dailyBackupsToKeep), createObject('value', 0))]",
-                  "backupEnabled": "[if(contains(parameters('volumes')[copyIndex()], 'backupEnabled'), createObject('value', parameters('volumes')[copyIndex()].backupEnabled), createObject('value', false()))]",
-                  "monthlyBackupsToKeep": "[if(contains(parameters('volumes')[copyIndex()], 'monthlyBackupsToKeep'), createObject('value', parameters('volumes')[copyIndex()].monthlyBackupsToKeep), createObject('value', 0))]",
-                  "weeklyBackupsToKeep": "[if(contains(parameters('volumes')[copyIndex()], 'weeklyBackupsToKeep'), createObject('value', parameters('volumes')[copyIndex()].weeklyBackupsToKeep), createObject('value', 0))]",
-                  "backupVaultName": "[if(contains(parameters('volumes')[copyIndex()], 'backupVaultName'), createObject('value', parameters('volumes')[copyIndex()].backupVaultName), createObject('value', 'vault'))]",
-                  "backupVaultLocation": "[if(contains(parameters('volumes')[copyIndex()], 'backupVaultLocation'), createObject('value', parameters('volumes')[copyIndex()].backupVaultLocation), createObject('value', ''))]",
-                  "backupName": "[if(contains(parameters('volumes')[copyIndex()], 'backupName'), createObject('value', parameters('volumes')[copyIndex()].backupName), createObject('value', 'backup'))]",
-                  "backupLabel": "[if(contains(parameters('volumes')[copyIndex()], 'backupLabel'), createObject('value', parameters('volumes')[copyIndex()].backupLabel), createObject('value', ''))]",
-                  "snapshotName": "[if(contains(parameters('volumes')[copyIndex()], 'snapshotName'), createObject('value', parameters('volumes')[copyIndex()].snapshotName), createObject('value', 'snapshot'))]",
-                  "useExistingSnapshot": "[if(contains(parameters('volumes')[copyIndex()], 'useExistingSnapshot'), createObject('value', parameters('volumes')[copyIndex()].useExistingSnapshot), createObject('value', false()))]",
-                  "volumeResourceId": "[if(contains(parameters('volumes')[copyIndex()], 'volumeResourceId'), createObject('value', parameters('volumes')[copyIndex()].volumeResourceId), createObject('value', ''))]"
+                  "coolAccess": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'coolAccess'), false())]"
+                  },
+                  "coolAccessRetrievalPolicy": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'coolAccessRetrievalPolicy'), 'Default')]"
+                  },
+                  "coolnessPeriod": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'coolnessPeriod'), 0)]"
+                  },
+                  "encryptionKeySource": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'encryptionKeySource'), 'Microsoft.NetApp')]"
+                  },
+                  "keyVaultPrivateEndpointResourceId": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'keyVaultPrivateEndpointResourceId'), '')]"
+                  },
+                  "endpointType": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'endpointType'), '')]"
+                  },
+                  "remoteVolumeRegion": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'remoteVolumeRegion'), '')]"
+                  },
+                  "remoteVolumeResourceId": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'remoteVolumeResourceId'), '')]"
+                  },
+                  "replicationSchedule": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'replicationSchedule'), '')]"
+                  },
+                  "snapshotPolicyId": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotPolicyId'), '')]"
+                  },
+                  "snapshotPolicyName": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotPolicyName'), 'snapshotPolicy')]"
+                  },
+                  "snapshotPolicyLocation": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotPolicyLocation'), '')]"
+                  },
+                  "snapEnabled": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapEnabled'), false())]"
+                  },
+                  "dailyHour": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyHour'), 0)]"
+                  },
+                  "dailyMinute": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyMinute'), 0)]"
+                  },
+                  "dailySnapshotsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailySnapshotsToKeep'), 0)]"
+                  },
+                  "dailyUsedBytes": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyUsedBytes'), 0)]"
+                  },
+                  "hourlyMinute": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'hourlyMinute'), 0)]"
+                  },
+                  "hourlySnapshotsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'hourlySnapshotsToKeep'), 0)]"
+                  },
+                  "hourlyUsedBytes": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'hourlyUsedBytes'), 0)]"
+                  },
+                  "daysOfMonth": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'daysOfMonth'), '')]"
+                  },
+                  "monthlyHour": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyHour'), 0)]"
+                  },
+                  "monthlyMinute": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyMinute'), 0)]"
+                  },
+                  "monthlySnapshotsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlySnapshotsToKeep'), 0)]"
+                  },
+                  "monthlyUsedBytes": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyUsedBytes'), 0)]"
+                  },
+                  "weeklyDay": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyDay'), '')]"
+                  },
+                  "weeklyHour": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyHour'), 0)]"
+                  },
+                  "weeklyMinute": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyMinute'), 0)]"
+                  },
+                  "weeklySnapshotsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklySnapshotsToKeep'), 0)]"
+                  },
+                  "weeklyUsedBytes": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyUsedBytes'), 0)]"
+                  },
+                  "backupPolicyName": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupPolicyName'), 'backupPolicy')]"
+                  },
+                  "backupPolicyLocation": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupPolicyLocation'), '')]"
+                  },
+                  "dailyBackupsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'dailyBackupsToKeep'), 0)]"
+                  },
+                  "backupEnabled": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupEnabled'), false())]"
+                  },
+                  "monthlyBackupsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'monthlyBackupsToKeep'), 0)]"
+                  },
+                  "weeklyBackupsToKeep": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'weeklyBackupsToKeep'), 0)]"
+                  },
+                  "backupVaultName": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupVaultName'), 'vault')]"
+                  },
+                  "backupVaultLocation": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupVaultLocation'), '')]"
+                  },
+                  "backupName": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupName'), 'backup')]"
+                  },
+                  "backupLabel": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'backupLabel'), '')]"
+                  },
+                  "snapshotName": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'snapshotName'), 'snapshot')]"
+                  },
+                  "useExistingSnapshot": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'useExistingSnapshot'), false())]"
+                  },
+                  "volumeResourceId": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'volumeResourceId'), '')]"
+                  },
+                  "volumeType": {
+                    "value": "[coalesce(tryGet(parameters('volumes')[copyIndex()], 'volumeType'), '')]"
+                  }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -807,7 +939,7 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "1599719170493782479"
+                      "templateHash": "6870432140728658293"
                     },
                     "name": "Azure NetApp Files Capacity Pool Volumes",
                     "description": "This module deploys an Azure NetApp Files Capacity Pool Volume.",
@@ -920,6 +1052,18 @@
                         "description": "Optional. determines the data retrieval behavior from the cool tier to standard storage based on the read pattern for cool access enabled volumes (Default/Never/Read)."
                       }
                     },
+                    "encryptionKeySource": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. The source of the encryption key."
+                      }
+                    },
+                    "keyVaultPrivateEndpointResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. The resource ID of the key vault private endpoint."
+                      }
+                    },
                     "endpointType": {
                       "type": "string",
                       "metadata": {
@@ -1021,12 +1165,146 @@
                         "description": "Optional. The name of the snapshot."
                       }
                     },
+                    "snapshotPolicyId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. Snapshot Policy ResourceId."
+                      }
+                    },
+                    "snapshotPolicyName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. The name of the snapshot policy."
+                      }
+                    },
+                    "snapshotPolicyLocation": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. The location of the snapshot policy."
+                      }
+                    },
+                    "dailyHour": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The daily snapshot hour."
+                      }
+                    },
+                    "dailyMinute": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The daily snapshot minute."
+                      }
+                    },
+                    "dailySnapshotsToKeep": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Daily snapshot count to keep."
+                      }
+                    },
+                    "dailyUsedBytes": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Daily snapshot used bytes."
+                      }
+                    },
+                    "hourlyMinute": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The hourly snapshot minute."
+                      }
+                    },
+                    "hourlySnapshotsToKeep": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Hourly snapshot count to keep."
+                      }
+                    },
+                    "hourlyUsedBytes": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Hourly snapshot used bytes."
+                      }
+                    },
+                    "daysOfMonth": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. The monthly snapshot day."
+                      }
+                    },
+                    "monthlyHour": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The monthly snapshot hour."
+                      }
+                    },
+                    "monthlyMinute": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The monthly snapshot minute."
+                      }
+                    },
+                    "monthlySnapshotsToKeep": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Monthly snapshot count to keep."
+                      }
+                    },
+                    "monthlyUsedBytes": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Monthly snapshot used bytes."
+                      }
+                    },
+                    "weeklyDay": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. The weekly snapshot day."
+                      }
+                    },
+                    "weeklyHour": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The weekly snapshot hour."
+                      }
+                    },
+                    "weeklyMinute": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. The weekly snapshot minute."
+                      }
+                    },
+                    "weeklySnapshotsToKeep": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Weekly snapshot count to keep."
+                      }
+                    },
+                    "weeklyUsedBytes": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Optional. Weekly snapshot used bytes."
+                      }
+                    },
+                    "snapEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether the snapshot policy is enabled."
+                      }
+                    },
                     "volumeResourceId": {
                       "type": "string",
                       "metadata": {
                         "description": "Optional. The resource ID of the volume."
                       }
                     },
+                    "volumeType": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Optional. The type of the volume. DataProtection volumes are used for replication."
+                      }
+                    },
                     "name": {
                       "type": "string",
                       "metadata": {
@@ -1135,7 +1413,7 @@
                     "netAppAccount::capacityPool": {
                       "existing": true,
                       "type": "Microsoft.NetApp/netAppAccounts/capacityPools",
-                      "apiVersion": "2023-07-01",
+                      "apiVersion": "2024-03-01",
                       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('capacityPoolName'))]",
                       "dependsOn": [
                         "netAppAccount"
@@ -1144,24 +1422,62 @@
                     "netAppAccount": {
                       "existing": true,
                       "type": "Microsoft.NetApp/netAppAccounts",
-                      "apiVersion": "2023-07-01",
+                      "apiVersion": "2024-03-01",
                       "name": "[parameters('netAppAccountName')]"
                     },
                     "volume": {
                       "type": "Microsoft.NetApp/netAppAccounts/capacityPools/volumes",
-                      "apiVersion": "2023-07-01",
+                      "apiVersion": "2024-03-01",
                       "name": "[format('{0}/{1}/{2}', parameters('netAppAccountName'), parameters('capacityPoolName'), parameters('name'))]",
                       "location": "[parameters('location')]",
-                      "properties": "[shallowMerge(createArray(createObject('coolAccess', parameters('coolAccess'), 'coolAccessRetrievalPolicy', parameters('coolAccessRetrievalPolicy'), 'coolnessPeriod', parameters('coolnessPeriod')), if(not(equals(parameters('endpointType'), '')), createObject('dataProtection', createObject('replication', createObject('endpointType', parameters('endpointType'), 'remoteVolumeRegion', parameters('remoteVolumeRegion'), 'remoteVolumeResourceId', parameters('remoteVolumeResourceId'), 'replicationSchedule', parameters('replicationSchedule')))), createObject()), createObject('networkFeatures', parameters('networkFeatures'), 'serviceLevel', parameters('serviceLevel'), 'creationToken', parameters('creationToken'), 'usageThreshold', parameters('usageThreshold'), 'protocolTypes', parameters('protocolTypes'), 'subnetId', parameters('subnetResourceId'), 'exportPolicy', if(not(empty(parameters('exportPolicyRules'))), createObject('rules', parameters('exportPolicyRules')), null()))))]",
+                      "properties": "[shallowMerge(createArray(createObject('coolAccess', parameters('coolAccess'), 'coolAccessRetrievalPolicy', parameters('coolAccessRetrievalPolicy'), 'coolnessPeriod', parameters('coolnessPeriod'), 'encryptionKeySource', parameters('encryptionKeySource')), if(not(equals(parameters('encryptionKeySource'), 'Microsoft.NetApp')), createObject('keyVaultPrivateEndpointResourceId', parameters('keyVaultPrivateEndpointResourceId')), createObject()), if(not(equals(parameters('volumeType'), '')), createObject('volumeType', parameters('volumeType'), 'dataProtection', createObject('replication', createObject('endpointType', parameters('endpointType'), 'remoteVolumeRegion', parameters('remoteVolumeRegion'), 'remoteVolumeResourceId', parameters('remoteVolumeResourceId'), 'replicationSchedule', parameters('replicationSchedule')), 'snapshot', createObject('snapshotPolicyId', parameters('snapshotPolicyId')))), createObject()), createObject('networkFeatures', parameters('networkFeatures'), 'serviceLevel', parameters('serviceLevel'), 'creationToken', parameters('creationToken'), 'usageThreshold', parameters('usageThreshold'), 'protocolTypes', parameters('protocolTypes'), 'subnetId', parameters('subnetResourceId'), 'exportPolicy', if(not(empty(parameters('exportPolicyRules'))), createObject('rules', parameters('exportPolicyRules')), null()))))]",
                       "zones": "[parameters('zones')]",
                       "dependsOn": [
                         "netAppAccount::capacityPool"
                       ]
                     },
+                    "snapshotPolicies": {
+                      "condition": "[parameters('snapEnabled')]",
+                      "type": "Microsoft.NetApp/netAppAccounts/snapshotPolicies",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('snapshotPolicyName'))]",
+                      "location": "[parameters('snapshotPolicyLocation')]",
+                      "properties": {
+                        "enabled": "[parameters('snapEnabled')]",
+                        "dailySchedule": {
+                          "hour": "[parameters('dailyHour')]",
+                          "minute": "[parameters('dailyMinute')]",
+                          "snapshotsToKeep": "[parameters('dailySnapshotsToKeep')]",
+                          "usedBytes": "[parameters('dailyUsedBytes')]"
+                        },
+                        "hourlySchedule": {
+                          "minute": "[parameters('hourlyMinute')]",
+                          "snapshotsToKeep": "[parameters('hourlySnapshotsToKeep')]",
+                          "usedBytes": "[parameters('hourlyUsedBytes')]"
+                        },
+                        "monthlySchedule": {
+                          "daysOfMonth": "[parameters('daysOfMonth')]",
+                          "hour": "[parameters('monthlyHour')]",
+                          "minute": "[parameters('monthlyMinute')]",
+                          "snapshotsToKeep": "[parameters('monthlySnapshotsToKeep')]",
+                          "usedBytes": "[parameters('monthlyUsedBytes')]"
+                        },
+                        "weeklySchedule": {
+                          "day": "[parameters('weeklyDay')]",
+                          "hour": "[parameters('weeklyHour')]",
+                          "minute": "[parameters('weeklyMinute')]",
+                          "snapshotsToKeep": "[parameters('weeklySnapshotsToKeep')]",
+                          "usedBytes": "[parameters('weeklyUsedBytes')]"
+                        }
+                      },
+                      "dependsOn": [
+                        "netAppAccount"
+                      ]
+                    },
                     "backupPolicies": {
                       "condition": "[parameters('backupEnabled')]",
                       "type": "Microsoft.NetApp/netAppAccounts/backupPolicies",
-                      "apiVersion": "2023-11-01",
+                      "apiVersion": "2024-03-01",
                       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('backupPolicyName'))]",
                       "location": "[parameters('backupPolicyLocation')]",
                       "properties": {
@@ -1177,7 +1493,7 @@
                     "backupVaults": {
                       "condition": "[parameters('backupEnabled')]",
                       "type": "Microsoft.NetApp/netAppAccounts/backupVaults",
-                      "apiVersion": "2023-05-01-preview",
+                      "apiVersion": "2024-03-01",
                       "name": "[format('{0}/{1}', parameters('netAppAccountName'), parameters('backupVaultName'))]",
                       "location": "[parameters('backupVaultLocation')]",
                       "properties": {},
@@ -1188,7 +1504,7 @@
                     "backups": {
                       "condition": "[parameters('backupEnabled')]",
                       "type": "Microsoft.NetApp/netAppAccounts/backupVaults/backups",
-                      "apiVersion": "2023-05-01-preview",
+                      "apiVersion": "2024-03-01",
                       "name": "[format('{0}/{1}/{2}', parameters('netAppAccountName'), parameters('backupVaultName'), parameters('backupName'))]",
                       "properties": "[if(parameters('backupEnabled'), createObject('label', parameters('backupLabel'), 'snapshotName', parameters('snapshotName'), 'useExistingSnapshot', parameters('useExistingSnapshot'), 'volumeResourceId', parameters('volumeResourceId')), createObject())]",
                       "dependsOn": [
@@ -1245,7 +1561,7 @@
                       "metadata": {
                         "description": "The location the resource was deployed into."
                       },
-                      "value": "[reference('volume', '2023-07-01', 'full').location]"
+                      "value": "[reference('volume', '2024-03-01', 'full').location]"
                     }
                   }
                 }
@@ -1283,7 +1599,7 @@
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('capacityPool', '2023-07-01', 'full').location]"
+              "value": "[reference('capacityPool', '2024-03-01', 'full').location]"
             },
             "volumeResourceId": {
               "type": "string",
@@ -1327,7 +1643,7 @@
       "metadata": {
         "description": "The location the resource was deployed into."
       },
-      "value": "[reference('netAppAccount', '2023-07-01', 'full').location]"
+      "value": "[reference('netAppAccount', '2024-03-01', 'full').location]"
     },
     "volumeResourceId": {
       "type": "string",
diff --git a/avm/res/net-app/net-app-account/tests/e2e/max/main.test.bicep b/avm/res/net-app/net-app-account/tests/e2e/max/main.test.bicep
index f0054227f1..0dc7ad7b1f 100644
--- a/avm/res/net-app/net-app-account/tests/e2e/max/main.test.bicep
+++ b/avm/res/net-app/net-app-account/tests/e2e/max/main.test.bicep
@@ -21,6 +21,9 @@ param serviceShort string = 'nanaamax'
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Optional. The source of the encryption key.')
+param encryptionKeySource string = 'Microsoft.NetApp'
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -79,6 +82,7 @@ module testDeployment '../../../main.bicep' = {
             name: '${namePrefix}-${serviceShort}-vol-001'
             zones: ['1']
             networkFeatures: 'Standard'
+            encryptionKeySource: encryptionKeySource
             protocolTypes: [
               'NFSv4.1'
             ]
@@ -106,6 +110,7 @@ module testDeployment '../../../main.bicep' = {
             name: '${namePrefix}-${serviceShort}-vol-002'
             zones: ['1']
             networkFeatures: 'Standard'
+            encryptionKeySource: encryptionKeySource
             protocolTypes: [
               'NFSv4.1'
             ]
diff --git a/avm/res/net-app/net-app-account/tests/e2e/nfs3/main.test.bicep b/avm/res/net-app/net-app-account/tests/e2e/nfs3/main.test.bicep
index 23282163a3..2a49696c4e 100644
--- a/avm/res/net-app/net-app-account/tests/e2e/nfs3/main.test.bicep
+++ b/avm/res/net-app/net-app-account/tests/e2e/nfs3/main.test.bicep
@@ -21,6 +21,9 @@ param serviceShort string = 'nanaanfs3'
 @description('Optional. A token to inject into the name of each resource.')
 param namePrefix string = '#_namePrefix_#'
 
+@description('Optional. The source of the encryption key.')
+param encryptionKeySource string = 'Microsoft.NetApp'
+
 // ============ //
 // Dependencies //
 // ============ //
@@ -79,6 +82,7 @@ module testDeployment '../../../main.bicep' = {
             name: '${namePrefix}-${serviceShort}-vol-001'
             zones: ['1']
             networkFeatures: 'Standard'
+            encryptionKeySource: encryptionKeySource
             protocolTypes: [
               'NFSv3'
             ]
@@ -96,6 +100,7 @@ module testDeployment '../../../main.bicep' = {
             name: '${namePrefix}-${serviceShort}-vol-002'
             zones: ['1']
             networkFeatures: 'Standard'
+            encryptionKeySource: encryptionKeySource
             protocolTypes: [
               'NFSv3'
             ]
diff --git a/avm/res/network/application-gateway/README.md b/avm/res/network/application-gateway/README.md
index c8e705634b..b5d206d002 100644
--- a/avm/res/network/application-gateway/README.md
+++ b/avm/res/network/application-gateway/README.md
@@ -19,8 +19,8 @@ This module deploys a Network Application Gateway.
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
 | `Microsoft.Network/applicationGateways` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/applicationGateways) |
-| `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
-| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 
 ## Usage examples
 
@@ -127,14 +127,6 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
         }
       }
     ]
-    webApplicationFirewallConfiguration: {
-      enabled: false
-    }
-    zones: [
-      '1'
-      '2'
-      '3'
-    ]
   }
 }
 ```
@@ -248,18 +240,6 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
           }
         }
       ]
-    },
-    "webApplicationFirewallConfiguration": {
-      "value": {
-        "enabled": false
-      }
-    },
-    "zones": {
-      "value": [
-        "1",
-        "2",
-        "3"
-      ]
     }
   }
 }
@@ -483,9 +463,13 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'public'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -662,11 +646,13 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     ]
     roleAssignments: [
       {
+        name: '97fc1da9-bfe4-409d-b17a-da9a82fad0d0'
         principalId: '<principalId>'
         principalType: 'ServicePrincipal'
         roleDefinitionIdOrName: 'Owner'
       }
       {
+        name: '<name>'
         principalId: '<principalId>'
         principalType: 'ServicePrincipal'
         roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
@@ -968,9 +954,13 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "public",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -1159,11 +1149,13 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     "roleAssignments": {
       "value": [
         {
+          "name": "97fc1da9-bfe4-409d-b17a-da9a82fad0d0",
           "principalId": "<principalId>",
           "principalType": "ServicePrincipal",
           "roleDefinitionIdOrName": "Owner"
         },
         {
+          "name": "<name>",
           "principalId": "<principalId>",
           "principalType": "ServicePrincipal",
           "roleDefinitionIdOrName": "b24988ac-6180-42a0-ab88-20f7382dd24c"
@@ -1317,6 +1309,7 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     ]
     enableHttp2: true
     enableTelemetry: '<enableTelemetry>'
+    firewallPolicyResourceId: '<firewallPolicyResourceId>'
     frontendIPConfigurations: [
       {
         name: 'private'
@@ -1453,9 +1446,13 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'public'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -1644,20 +1641,6 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
       'hidden-title': 'This is visible in the resource name'
       Role: 'DeploymentValidation'
     }
-    webApplicationFirewallConfiguration: {
-      enabled: true
-      fileUploadLimitInMb: 100
-      firewallMode: 'Prevention'
-      maxRequestBodySizeInKb: 128
-      requestBodyCheck: true
-      ruleSetType: 'OWASP'
-      ruleSetVersion: '3.0'
-    }
-    zones: [
-      '1'
-      '2'
-      '3'
-    ]
   }
 }
 ```
@@ -1752,6 +1735,9 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     "enableTelemetry": {
       "value": "<enableTelemetry>"
     },
+    "firewallPolicyResourceId": {
+      "value": "<firewallPolicyResourceId>"
+    },
     "frontendIPConfigurations": {
       "value": [
         {
@@ -1903,9 +1889,13 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "public",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -2110,24 +2100,6 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
         "hidden-title": "This is visible in the resource name",
         "Role": "DeploymentValidation"
       }
-    },
-    "webApplicationFirewallConfiguration": {
-      "value": {
-        "enabled": true,
-        "fileUploadLimitInMb": 100,
-        "firewallMode": "Prevention",
-        "maxRequestBodySizeInKb": 128,
-        "requestBodyCheck": true,
-        "ruleSetType": "OWASP",
-        "ruleSetVersion": "3.0"
-      }
-    },
-    "zones": {
-      "value": [
-        "1",
-        "2",
-        "3"
-      ]
     }
   }
 }
@@ -2162,7 +2134,7 @@ module applicationGateway 'br/public:avm/res/network/application-gateway:<versio
 | [`enableRequestBuffering`](#parameter-enablerequestbuffering) | bool | Enable request buffering. |
 | [`enableResponseBuffering`](#parameter-enableresponsebuffering) | bool | Enable response buffering. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
-| [`firewallPolicyId`](#parameter-firewallpolicyid) | string | The resource ID of an associated firewall policy. Should be configured for security reasons. |
+| [`firewallPolicyResourceId`](#parameter-firewallpolicyresourceid) | string | The resource ID of an associated firewall policy. Should be configured for security reasons. |
 | [`frontendIPConfigurations`](#parameter-frontendipconfigurations) | array | Frontend IP addresses of the application gateway resource. |
 | [`frontendPorts`](#parameter-frontendports) | array | Frontend ports of the application gateway resource. |
 | [`gatewayIPConfigurations`](#parameter-gatewayipconfigurations) | array | Subnets of the application gateway resource. |
@@ -2451,7 +2423,7 @@ Enable/Disable usage telemetry for module.
 - Type: bool
 - Default: `True`
 
-### Parameter: `firewallPolicyId`
+### Parameter: `firewallPolicyResourceId`
 
 The resource ID of an associated firewall policy. Should be configured for security reasons.
 
@@ -2599,8 +2571,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2790,19 +2761,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -2840,6 +2856,7 @@ Array of role assignments to create.
 | [`conditionVersion`](#parameter-privateendpointsroleassignmentsconditionversion) | string | Version of the condition. |
 | [`delegatedManagedIdentityResourceId`](#parameter-privateendpointsroleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
 | [`description`](#parameter-privateendpointsroleassignmentsdescription) | string | The description of the role assignment. |
+| [`name`](#parameter-privateendpointsroleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
 | [`principalType`](#parameter-privateendpointsroleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
 
 ### Parameter: `privateEndpoints.roleAssignments.principalId`
@@ -2890,6 +2907,13 @@ The description of the role assignment.
 - Required: No
 - Type: string
 
+### Parameter: `privateEndpoints.roleAssignments.name`
+
+The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+
+- Required: No
+- Type: string
+
 ### Parameter: `privateEndpoints.roleAssignments.principalType`
 
 The principal type of the assigned principal ID.
@@ -2976,6 +3000,7 @@ Array of role assignments to create.
 | [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
 | [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
 | [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
+| [`name`](#parameter-roleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
 | [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
 
 ### Parameter: `roleAssignments.principalId`
@@ -3026,6 +3051,13 @@ The description of the role assignment.
 - Required: No
 - Type: string
 
+### Parameter: `roleAssignments.name`
+
+The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+
+- Required: No
+- Type: string
+
 ### Parameter: `roleAssignments.principalType`
 
 The principal type of the assigned principal ID.
@@ -3057,7 +3089,7 @@ The name of the SKU for the Application Gateway.
 
 - Required: No
 - Type: string
-- Default: `'WAF_v2'`
+- Default: `'Standard_v2'`
 - Allowed:
   ```Bicep
   [
@@ -3231,7 +3263,14 @@ A list of availability zones denoting where the resource needs to come from.
 
 - Required: No
 - Type: array
-- Default: `[]`
+- Default:
+  ```Bicep
+  [
+    1
+    2
+    3
+  ]
+  ```
 
 ## Outputs
 
@@ -3239,6 +3278,7 @@ A list of availability zones denoting where the resource needs to come from.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the application gateway. |
+| `privateEndpoints` | array | The private endpoints of the application gateway. |
 | `resourceGroupName` | string | The resource group the application gateway was deployed into. |
 | `resourceId` | string | The resource ID of the application gateway. |
 
@@ -3248,7 +3288,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.4.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/network/application-gateway/main.bicep b/avm/res/network/application-gateway/main.bicep
index 446e40cb3c..636fa01efb 100644
--- a/avm/res/network/application-gateway/main.bicep
+++ b/avm/res/network/application-gateway/main.bicep
@@ -37,7 +37,7 @@ param enableFips bool = false
 param enableHttp2 bool = false
 
 @description('Optional. The resource ID of an associated firewall policy. Should be configured for security reasons.')
-param firewallPolicyId string = ''
+param firewallPolicyResourceId string = ''
 
 @description('Optional. Frontend IP addresses of the application gateway resource.')
 param frontendIPConfigurations array = []
@@ -88,7 +88,7 @@ param rewriteRuleSets array = []
   'Standard_v2'
   'WAF_v2'
 ])
-param sku string = 'WAF_v2'
+param sku string = 'Standard_v2'
 
 @description('Optional. The number of Application instances to be configured.')
 @minValue(0)
@@ -178,7 +178,11 @@ param urlPathMaps array = []
 param webApplicationFirewallConfiguration object = {}
 
 @description('Optional. A list of availability zones denoting where the resource needs to come from.')
-param zones array = []
+param zones array = [
+  1
+  2
+  3
+]
 
 @description('Optional. The diagnostic settings of the service.')
 param diagnosticSettings diagnosticSettingType
@@ -231,6 +235,17 @@ var builtInRoleNames = {
   )
 }
 
+var formattedRoleAssignments = [
+  for (roleAssignment, index) in (roleAssignments ?? []): union(roleAssignment, {
+    roleDefinitionId: builtInRoleNames[?roleAssignment.roleDefinitionIdOrName] ?? (contains(
+        roleAssignment.roleDefinitionIdOrName,
+        '/providers/Microsoft.Authorization/roleDefinitions/'
+      )
+      ? roleAssignment.roleDefinitionIdOrName
+      : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName))
+  })
+]
+
 #disable-next-line no-deployments-resources
 resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
   name: '46d3xbcp.res.network-appgw.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
@@ -269,12 +284,12 @@ resource applicationGateway 'Microsoft.Network/applicationGateways@2023-04-01' =
       backendSettingsCollection: backendSettingsCollection
       customErrorConfigurations: customErrorConfigurations
       enableHttp2: enableHttp2
-      firewallPolicy: !empty(firewallPolicyId)
+      firewallPolicy: !empty(firewallPolicyResourceId)
         ? {
-            id: firewallPolicyId
+            id: firewallPolicyResourceId
           }
         : null
-      forceFirewallPolicyAssociation: !empty(firewallPolicyId)
+      forceFirewallPolicyAssociation: !empty(firewallPolicyResourceId)
       frontendIPConfigurations: frontendIPConfigurations
       frontendPorts: frontendPorts
       gatewayIPConfigurations: gatewayIPConfigurations
@@ -367,7 +382,7 @@ resource applicationGateway_diagnosticSettings 'Microsoft.Insights/diagnosticSet
   }
 ]
 
-module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4.1' = [
+module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-applicationGateway-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -408,8 +423,7 @@ module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-en
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -421,14 +435,14 @@ module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-en
 ]
 
 resource applicationGateway_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
-  for (roleAssignment, index) in (roleAssignments ?? []): {
-    name: guid(applicationGateway.id, roleAssignment.principalId, roleAssignment.roleDefinitionIdOrName)
+  for (roleAssignment, index) in (formattedRoleAssignments ?? []): {
+    name: roleAssignment.?name ?? guid(
+      applicationGateway.id,
+      roleAssignment.principalId,
+      roleAssignment.roleDefinitionId
+    )
     properties: {
-      roleDefinitionId: contains(builtInRoleNames, roleAssignment.roleDefinitionIdOrName)
-        ? builtInRoleNames[roleAssignment.roleDefinitionIdOrName]
-        : contains(roleAssignment.roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/')
-            ? roleAssignment.roleDefinitionIdOrName
-            : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName)
+      roleDefinitionId: roleAssignment.roleDefinitionId
       principalId: roleAssignment.principalId
       description: roleAssignment.?description
       principalType: roleAssignment.?principalType
@@ -452,6 +466,17 @@ output resourceGroupName string = resourceGroup().name
 @description('The location the resource was deployed into.')
 output location string = applicationGateway.location
 
+@description('The private endpoints of the application gateway.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: applicationGateway_privateEndpoints[i].outputs.name
+    resourceId: applicationGateway_privateEndpoints[i].outputs.resourceId
+    groupId: applicationGateway_privateEndpoints[i].outputs.groupId
+    customDnsConfig: applicationGateway_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: applicationGateway_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -470,6 +495,9 @@ type lockType = {
 }?
 
 type roleAssignmentType = {
+  @description('Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated.')
+  name: string?
+
   @description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
   roleDefinitionIdOrName: string
 
@@ -508,11 +536,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/network/application-gateway/main.json b/avm/res/network/application-gateway/main.json
index 7d41028c55..7876f434e6 100644
--- a/avm/res/network/application-gateway/main.json
+++ b/avm/res/network/application-gateway/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "362505319250929767"
+      "version": "0.29.47.4906",
+      "templateHash": "10337247586212656300"
     },
     "name": "Network Application Gateways",
     "description": "This module deploys a Network Application Gateway.",
@@ -58,6 +58,13 @@
       "items": {
         "type": "object",
         "properties": {
+          "name": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+            }
+          },
           "roleDefinitionIdOrName": {
             "type": "string",
             "metadata": {
@@ -157,21 +164,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -513,7 +543,7 @@
         "description": "Optional. Whether HTTP2 is enabled on the application gateway resource."
       }
     },
-    "firewallPolicyId": {
+    "firewallPolicyResourceId": {
       "type": "string",
       "defaultValue": "",
       "metadata": {
@@ -612,7 +642,7 @@
     },
     "sku": {
       "type": "string",
-      "defaultValue": "WAF_v2",
+      "defaultValue": "Standard_v2",
       "allowedValues": [
         "Standard_Small",
         "Standard_Medium",
@@ -759,7 +789,11 @@
     },
     "zones": {
       "type": "array",
-      "defaultValue": [],
+      "defaultValue": [
+        1,
+        2,
+        3
+      ],
       "metadata": {
         "description": "Optional. A list of availability zones denoting where the resource needs to come from."
       }
@@ -819,6 +853,13 @@
     }
   },
   "variables": {
+    "copy": [
+      {
+        "name": "formattedRoleAssignments",
+        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+      }
+    ],
     "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
     "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null()), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
     "builtInRoleNames": {
@@ -857,7 +898,7 @@
       "location": "[parameters('location')]",
       "tags": "[parameters('tags')]",
       "identity": "[variables('identity')]",
-      "properties": "[union(createObject('authenticationCertificates', parameters('authenticationCertificates'), 'autoscaleConfiguration', if(and(greater(parameters('autoscaleMaxCapacity'), 0), greaterOrEquals(parameters('autoscaleMinCapacity'), 0)), createObject('maxCapacity', parameters('autoscaleMaxCapacity'), 'minCapacity', parameters('autoscaleMinCapacity')), null()), 'backendAddressPools', parameters('backendAddressPools'), 'backendHttpSettingsCollection', parameters('backendHttpSettingsCollection'), 'backendSettingsCollection', parameters('backendSettingsCollection'), 'customErrorConfigurations', parameters('customErrorConfigurations'), 'enableHttp2', parameters('enableHttp2'), 'firewallPolicy', if(not(empty(parameters('firewallPolicyId'))), createObject('id', parameters('firewallPolicyId')), null()), 'forceFirewallPolicyAssociation', not(empty(parameters('firewallPolicyId'))), 'frontendIPConfigurations', parameters('frontendIPConfigurations'), 'frontendPorts', parameters('frontendPorts'), 'gatewayIPConfigurations', parameters('gatewayIPConfigurations'), 'globalConfiguration', if(endsWith(parameters('sku'), 'v2'), createObject('enableRequestBuffering', parameters('enableRequestBuffering'), 'enableResponseBuffering', parameters('enableResponseBuffering')), null()), 'httpListeners', parameters('httpListeners'), 'loadDistributionPolicies', parameters('loadDistributionPolicies'), 'listeners', parameters('listeners'), 'privateLinkConfigurations', parameters('privateLinkConfigurations'), 'probes', parameters('probes'), 'redirectConfigurations', parameters('redirectConfigurations'), 'requestRoutingRules', parameters('requestRoutingRules'), 'routingRules', parameters('routingRules'), 'rewriteRuleSets', parameters('rewriteRuleSets'), 'sku', createObject('name', parameters('sku'), 'tier', if(endsWith(parameters('sku'), 'v2'), parameters('sku'), substring(parameters('sku'), 0, indexOf(parameters('sku'), '_'))), 'capacity', if(and(greater(parameters('autoscaleMaxCapacity'), 0), greaterOrEquals(parameters('autoscaleMinCapacity'), 0)), null(), parameters('capacity'))), 'sslCertificates', parameters('sslCertificates'), 'sslPolicy', if(not(equals(parameters('sslPolicyType'), 'Predefined')), createObject('cipherSuites', parameters('sslPolicyCipherSuites'), 'minProtocolVersion', parameters('sslPolicyMinProtocolVersion'), 'policyName', if(empty(parameters('sslPolicyName')), null(), parameters('sslPolicyName')), 'policyType', parameters('sslPolicyType')), createObject('policyName', if(empty(parameters('sslPolicyName')), null(), parameters('sslPolicyName')), 'policyType', parameters('sslPolicyType'))), 'sslProfiles', parameters('sslProfiles'), 'trustedClientCertificates', parameters('trustedClientCertificates'), 'trustedRootCertificates', parameters('trustedRootCertificates'), 'urlPathMaps', parameters('urlPathMaps')), if(parameters('enableFips'), createObject('enableFips', parameters('enableFips')), createObject()), if(not(empty(parameters('webApplicationFirewallConfiguration'))), createObject('webApplicationFirewallConfiguration', parameters('webApplicationFirewallConfiguration')), createObject()))]",
+      "properties": "[union(createObject('authenticationCertificates', parameters('authenticationCertificates'), 'autoscaleConfiguration', if(and(greater(parameters('autoscaleMaxCapacity'), 0), greaterOrEquals(parameters('autoscaleMinCapacity'), 0)), createObject('maxCapacity', parameters('autoscaleMaxCapacity'), 'minCapacity', parameters('autoscaleMinCapacity')), null()), 'backendAddressPools', parameters('backendAddressPools'), 'backendHttpSettingsCollection', parameters('backendHttpSettingsCollection'), 'backendSettingsCollection', parameters('backendSettingsCollection'), 'customErrorConfigurations', parameters('customErrorConfigurations'), 'enableHttp2', parameters('enableHttp2'), 'firewallPolicy', if(not(empty(parameters('firewallPolicyResourceId'))), createObject('id', parameters('firewallPolicyResourceId')), null()), 'forceFirewallPolicyAssociation', not(empty(parameters('firewallPolicyResourceId'))), 'frontendIPConfigurations', parameters('frontendIPConfigurations'), 'frontendPorts', parameters('frontendPorts'), 'gatewayIPConfigurations', parameters('gatewayIPConfigurations'), 'globalConfiguration', if(endsWith(parameters('sku'), 'v2'), createObject('enableRequestBuffering', parameters('enableRequestBuffering'), 'enableResponseBuffering', parameters('enableResponseBuffering')), null()), 'httpListeners', parameters('httpListeners'), 'loadDistributionPolicies', parameters('loadDistributionPolicies'), 'listeners', parameters('listeners'), 'privateLinkConfigurations', parameters('privateLinkConfigurations'), 'probes', parameters('probes'), 'redirectConfigurations', parameters('redirectConfigurations'), 'requestRoutingRules', parameters('requestRoutingRules'), 'routingRules', parameters('routingRules'), 'rewriteRuleSets', parameters('rewriteRuleSets'), 'sku', createObject('name', parameters('sku'), 'tier', if(endsWith(parameters('sku'), 'v2'), parameters('sku'), substring(parameters('sku'), 0, indexOf(parameters('sku'), '_'))), 'capacity', if(and(greater(parameters('autoscaleMaxCapacity'), 0), greaterOrEquals(parameters('autoscaleMinCapacity'), 0)), null(), parameters('capacity'))), 'sslCertificates', parameters('sslCertificates'), 'sslPolicy', if(not(equals(parameters('sslPolicyType'), 'Predefined')), createObject('cipherSuites', parameters('sslPolicyCipherSuites'), 'minProtocolVersion', parameters('sslPolicyMinProtocolVersion'), 'policyName', if(empty(parameters('sslPolicyName')), null(), parameters('sslPolicyName')), 'policyType', parameters('sslPolicyType')), createObject('policyName', if(empty(parameters('sslPolicyName')), null(), parameters('sslPolicyName')), 'policyType', parameters('sslPolicyType'))), 'sslProfiles', parameters('sslProfiles'), 'trustedClientCertificates', parameters('trustedClientCertificates'), 'trustedRootCertificates', parameters('trustedRootCertificates'), 'urlPathMaps', parameters('urlPathMaps')), if(parameters('enableFips'), createObject('enableFips', parameters('enableFips')), createObject()), if(not(empty(parameters('webApplicationFirewallConfiguration'))), createObject('webApplicationFirewallConfiguration', parameters('webApplicationFirewallConfiguration')), createObject()))]",
       "zones": "[parameters('zones')]"
     },
     "applicationGateway_lock": {
@@ -918,20 +959,20 @@
     "applicationGateway_roleAssignments": {
       "copy": {
         "name": "applicationGateway_roleAssignments",
-        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
       },
       "type": "Microsoft.Authorization/roleAssignments",
       "apiVersion": "2022-04-01",
       "scope": "[format('Microsoft.Network/applicationGateways/{0}', parameters('name'))]",
-      "name": "[guid(resourceId('Microsoft.Network/applicationGateways', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/applicationGateways', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
       "properties": {
-        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
       },
       "dependsOn": [
         "applicationGateway"
@@ -969,11 +1010,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1001,19 +1039,47 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.25.53.49325",
-              "templateHash": "4120048060064073955"
+              "version": "0.29.47.4906",
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
                 "type": "object",
                 "properties": {
+                  "name": {
+                    "type": "string",
+                    "nullable": true,
+                    "metadata": {
+                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                    }
+                  },
                   "roleDefinitionIdOrName": {
                     "type": "string",
                     "metadata": {
@@ -1117,13 +1183,13 @@
                       "groupId": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "memberName": {
                         "type": "string",
                         "metadata": {
-                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                         }
                       },
                       "privateIPAddress": {
@@ -1157,8 +1223,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -1198,8 +1267,11 @@
                     "properties": {
                       "groupIds": {
                         "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
                         "metadata": {
-                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                          "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                         }
                       },
                       "privateLinkServiceId": {
@@ -1247,6 +1319,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1282,18 +1377,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1349,6 +1437,13 @@
             }
           },
           "variables": {
+            "copy": [
+              {
+                "name": "formattedRoleAssignments",
+                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+              }
+            ],
             "builtInRoleNames": {
               "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
               "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
@@ -1366,8 +1461,8 @@
             "avmTelemetry": {
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2023-07-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "apiVersion": "2024-03-01",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1385,7 +1480,7 @@
             },
             "privateEndpoint": {
               "type": "Microsoft.Network/privateEndpoints",
-              "apiVersion": "2023-04-01",
+              "apiVersion": "2023-11-01",
               "name": "[parameters('name')]",
               "location": "[parameters('location')]",
               "tags": "[parameters('tags')]",
@@ -1426,27 +1521,27 @@
             "privateEndpoint_roleAssignments": {
               "copy": {
                 "name": "privateEndpoint_roleAssignments",
-                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
               },
               "type": "Microsoft.Authorization/roleAssignments",
               "apiVersion": "2022-04-01",
               "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-              "name": "[guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
               "properties": {
-                "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
-                "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
-                "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
-                "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
-                "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
               },
               "dependsOn": [
                 "privateEndpoint"
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1457,28 +1552,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.25.53.49325",
-                      "templateHash": "11244630631275470040"
+                      "version": "0.29.47.4906",
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1486,12 +1605,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1505,27 +1627,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                      "apiVersion": "2023-04-01",
+                      "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1583,14 +1714,28 @@
               "metadata": {
                 "description": "The location the resource was deployed into."
               },
-              "value": "[reference('privateEndpoint', '2023-04-01', 'full').location]"
+              "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
+            },
+            "customDnsConfig": {
+              "$ref": "#/definitions/customDnsConfigType",
+              "metadata": {
+                "description": "The custom DNS configurations of the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').customDnsConfigs]"
+            },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
             },
             "groupId": {
               "type": "string",
               "metadata": {
                 "description": "The group Id for the private endpoint Group."
               },
-              "value": "[if(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties.groupIds[0], reference('privateEndpoint').privateLinkServiceConnections[0].properties.groupIds[0])]"
+              "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
             }
           }
         }
@@ -1628,6 +1773,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('applicationGateway', '2023-04-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the application gateway."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('applicationGateway_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('applicationGateway_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('applicationGateway_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('applicationGateway_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('applicationGateway_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/network/application-gateway/tests/e2e/defaults/main.test.bicep b/avm/res/network/application-gateway/tests/e2e/defaults/main.test.bicep
index 0998d2c453..8bb4990db1 100644
--- a/avm/res/network/application-gateway/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/network/application-gateway/tests/e2e/defaults/main.test.bicep
@@ -9,7 +9,6 @@ metadata description = 'This instance deploys the module with the minimum set of
 
 @description('Optional. The name of the resource group to deploy for testing purposes.')
 @maxLength(90)
-// e.g., for a module 'network/private-endpoint' you could use 'dep-dev-network.privateendpoints-${serviceShort}-rg'
 param resourceGroupName string = 'dep-${namePrefix}-network.applicationgateway-${serviceShort}-rg'
 
 @description('Optional. The location to deploy resources to.')
@@ -56,11 +55,6 @@ module testDeployment '../../../main.bicep' = [
     params: {
       // You parameters go here
       name: resourceName
-      zones: [
-        '1'
-        '2'
-        '3'
-      ]
       location: resourceLocation
       gatewayIPConfigurations: [
         {
@@ -138,9 +132,6 @@ module testDeployment '../../../main.bicep' = [
           }
         }
       ]
-      webApplicationFirewallConfiguration: {
-        enabled: false
-      }
     }
   }
 ]
diff --git a/avm/res/network/application-gateway/tests/e2e/max/main.test.bicep b/avm/res/network/application-gateway/tests/e2e/max/main.test.bicep
index 7e67afba91..9dfbbced50 100644
--- a/avm/res/network/application-gateway/tests/e2e/max/main.test.bicep
+++ b/avm/res/network/application-gateway/tests/e2e/max/main.test.bicep
@@ -169,9 +169,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'public'
           subnetResourceId: nestedDependencies.outputs.privateLinkSubnetResourceId
           tags: {
@@ -428,11 +432,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       roleAssignments: [
         {
+          name: '97fc1da9-bfe4-409d-b17a-da9a82fad0d0'
           roleDefinitionIdOrName: 'Owner'
           principalId: nestedDependencies.outputs.managedIdentityPrincipalId
           principalType: 'ServicePrincipal'
         }
         {
+          name: guid('Custom seed ${namePrefix}${serviceShort}')
           roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
           principalId: nestedDependencies.outputs.managedIdentityPrincipalId
           principalType: 'ServicePrincipal'
diff --git a/avm/res/network/application-gateway/tests/e2e/waf-aligned/dependencies.bicep b/avm/res/network/application-gateway/tests/e2e/waf-aligned/dependencies.bicep
index 2a9c2b0fae..4dd0bbe1d1 100644
--- a/avm/res/network/application-gateway/tests/e2e/waf-aligned/dependencies.bicep
+++ b/avm/res/network/application-gateway/tests/e2e/waf-aligned/dependencies.bicep
@@ -7,6 +7,9 @@ param virtualNetworkName string
 @description('Required. The name of the Public IP to create.')
 param publicIPName string
 
+@description('Required. The name of the Firewall Policy to create.')
+param fwPolicyName string
+
 @description('Required. The name of the Managed Identity to create.')
 param managedIdentityName string
 
@@ -132,6 +135,21 @@ resource certDeploymentScript 'Microsoft.Resources/deploymentScripts@2020-10-01'
   }
 }
 
+resource applicationGatewayWAFPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2022-11-01' = {
+  name: fwPolicyName
+  location: location
+  properties: {
+    managedRules: {
+      managedRuleSets: [
+        {
+          ruleSetType: 'OWASP'
+          ruleSetVersion: '3.2'
+        }
+      ]
+    }
+  }
+}
+
 @description('The resource ID of the created Virtual Network default subnet.')
 output defaultSubnetResourceId string = virtualNetwork.properties.subnets[0].id
 
@@ -152,3 +170,6 @@ output managedIdentityPrincipalId string = managedIdentity.properties.principalI
 
 @description('The resource ID of the created Private DNS Zone.')
 output privateDNSZoneResourceId string = privateDNSZone.id
+
+@description('The resource ID of the created Application Gateway Web Application Firewall Policy.')
+output fwPolicyResourceId string = applicationGatewayWAFPolicy.id
diff --git a/avm/res/network/application-gateway/tests/e2e/waf-aligned/main.test.bicep b/avm/res/network/application-gateway/tests/e2e/waf-aligned/main.test.bicep
index c6f9dede4f..a7eb20e1fc 100644
--- a/avm/res/network/application-gateway/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/network/application-gateway/tests/e2e/waf-aligned/main.test.bicep
@@ -43,6 +43,7 @@ module nestedDependencies 'dependencies.bicep' = {
   params: {
     location: resourceLocation
     virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    fwPolicyName: 'dep-${namePrefix}-fwp-${serviceShort}'
     publicIPName: 'dep-${namePrefix}-pip-${serviceShort}'
     managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
     certDeploymentScriptName: 'dep-${namePrefix}-ds-${serviceShort}'
@@ -79,11 +80,6 @@ module testDeployment '../../../main.bicep' = [
       location: resourceLocation
       enableTelemetry: enableTelemetry
       name: appGWName
-      zones: [
-        '1'
-        '2'
-        '3'
-      ]
       backendAddressPools: [
         {
           name: 'appServiceBackendPool'
@@ -169,9 +165,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'public'
           subnetResourceId: nestedDependencies.outputs.privateLinkSubnetResourceId
           tags: {
@@ -467,15 +467,7 @@ module testDeployment '../../../main.bicep' = [
           }
         }
       ]
-      webApplicationFirewallConfiguration: {
-        enabled: true
-        fileUploadLimitInMb: 100
-        firewallMode: 'Prevention'
-        maxRequestBodySizeInKb: 128
-        requestBodyCheck: true
-        ruleSetType: 'OWASP'
-        ruleSetVersion: '3.0'
-      }
+      firewallPolicyResourceId: nestedDependencies.outputs.fwPolicyResourceId
       tags: {
         'hidden-title': 'This is visible in the resource name'
         Environment: 'Non-Prod'
diff --git a/avm/res/network/application-gateway/version.json b/avm/res/network/application-gateway/version.json
index 7fa401bdf7..3f863a2bec 100644
--- a/avm/res/network/application-gateway/version.json
+++ b/avm/res/network/application-gateway/version.json
@@ -1,7 +1,7 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.1",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
-}
+}
\ No newline at end of file
diff --git a/avm/res/network/connection/README.md b/avm/res/network/connection/README.md
index 54841c5b30..1daee9d401 100644
--- a/avm/res/network/connection/README.md
+++ b/avm/res/network/connection/README.md
@@ -331,6 +331,7 @@ module connection 'br/public:avm/res/network/connection:<version>' = {
 | [`peer`](#parameter-peer) | object | The remote peer. Used for connection connectionType [ExpressRoute]. |
 | [`routingWeight`](#parameter-routingweight) | int | The weight added to routes learned from this BGP speaker. |
 | [`tags`](#parameter-tags) | object | Tags of the resource. |
+| [`trafficSelectorPolicies`](#parameter-trafficselectorpolicies) | array | The traffic selector policies to be considered by this connection. |
 | [`useLocalAzureIpAddress`](#parameter-uselocalazureipaddress) | bool | Use private local Azure IP for the connection. Only available for IPSec Virtual Network Gateways that use the Azure Private IP Property. |
 | [`usePolicyBasedTrafficSelectors`](#parameter-usepolicybasedtrafficselectors) | bool | Enable policy-based traffic selectors. |
 | [`virtualNetworkGateway2`](#parameter-virtualnetworkgateway2) | object | The remote Virtual Network Gateway. Used for connection connectionType [Vnet2Vnet]. |
@@ -540,6 +541,14 @@ Tags of the resource.
 - Required: No
 - Type: object
 
+### Parameter: `trafficSelectorPolicies`
+
+The traffic selector policies to be considered by this connection.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
 ### Parameter: `useLocalAzureIpAddress`
 
 Use private local Azure IP for the connection. Only available for IPSec Virtual Network Gateways that use the Azure Private IP Property.
diff --git a/avm/res/network/connection/main.bicep b/avm/res/network/connection/main.bicep
index 7521aa229f..28078935b7 100644
--- a/avm/res/network/connection/main.bicep
+++ b/avm/res/network/connection/main.bicep
@@ -47,6 +47,9 @@ param dpdTimeoutSeconds int = 45
 @description('Optional. Enable policy-based traffic selectors.')
 param usePolicyBasedTrafficSelectors bool = false
 
+@description('Optional. The traffic selector policies to be considered by this connection.')
+param trafficSelectorPolicies array = []
+
 @description('Optional. Bypass the ExpressRoute gateway when accessing private-links. ExpressRoute FastPath (expressRouteGatewayBypass) must be enabled. Only available when connection connectionType is Express Route.')
 param enablePrivateLinkFastPath bool = false
 
@@ -132,6 +135,7 @@ resource connection 'Microsoft.Network/connections@2023-04-01' = {
     peer: connectionType == 'ExpressRoute' ? peer : null
     authorizationKey: connectionType == 'ExpressRoute' && !empty(authorizationKey) ? authorizationKey : null
     sharedKey: connectionType != 'ExpressRoute' ? vpnSharedKey : null
+    trafficSelectorPolicies: trafficSelectorPolicies
     usePolicyBasedTrafficSelectors: usePolicyBasedTrafficSelectors
     ipsecPolicies: !empty(customIPSecPolicy.ipsecEncryption)
       ? [
diff --git a/avm/res/network/connection/main.json b/avm/res/network/connection/main.json
index f92bc886ea..ec725f9c35 100644
--- a/avm/res/network/connection/main.json
+++ b/avm/res/network/connection/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "16458068655280591810"
+      "version": "0.29.47.4906",
+      "templateHash": "13075925260036107325"
     },
     "name": "Virtual Network Gateway Connections",
     "description": "This module deploys a Virtual Network Gateway Connection.",
@@ -119,6 +119,13 @@
         "description": "Optional. Enable policy-based traffic selectors."
       }
     },
+    "trafficSelectorPolicies": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. The traffic selector policies to be considered by this connection."
+      }
+    },
     "enablePrivateLinkFastPath": {
       "type": "bool",
       "defaultValue": false,
@@ -258,6 +265,7 @@
         "peer": "[if(equals(parameters('connectionType'), 'ExpressRoute'), parameters('peer'), null())]",
         "authorizationKey": "[if(and(equals(parameters('connectionType'), 'ExpressRoute'), not(empty(parameters('authorizationKey')))), parameters('authorizationKey'), null())]",
         "sharedKey": "[if(not(equals(parameters('connectionType'), 'ExpressRoute')), parameters('vpnSharedKey'), null())]",
+        "trafficSelectorPolicies": "[parameters('trafficSelectorPolicies')]",
         "usePolicyBasedTrafficSelectors": "[parameters('usePolicyBasedTrafficSelectors')]",
         "ipsecPolicies": "[if(not(empty(parameters('customIPSecPolicy').ipsecEncryption)), createArray(createObject('saLifeTimeSeconds', parameters('customIPSecPolicy').saLifeTimeSeconds, 'saDataSizeKilobytes', parameters('customIPSecPolicy').saDataSizeKilobytes, 'ipsecEncryption', parameters('customIPSecPolicy').ipsecEncryption, 'ipsecIntegrity', parameters('customIPSecPolicy').ipsecIntegrity, 'ikeEncryption', parameters('customIPSecPolicy').ikeEncryption, 'ikeIntegrity', parameters('customIPSecPolicy').ikeIntegrity, 'dhGroup', parameters('customIPSecPolicy').dhGroup, 'pfsGroup', parameters('customIPSecPolicy').pfsGroup)), parameters('customIPSecPolicy').ipsecEncryption)]",
         "routingWeight": "[parameters('routingWeight')]",
diff --git a/avm/res/network/front-door-web-application-firewall-policy/main.bicep b/avm/res/network/front-door-web-application-firewall-policy/main.bicep
index c8b742477e..de60fe5ffc 100644
--- a/avm/res/network/front-door-web-application-firewall-policy/main.bicep
+++ b/avm/res/network/front-door-web-application-firewall-policy/main.bicep
@@ -102,7 +102,7 @@ var formattedRoleAssignments = [
 
 #disable-next-line no-deployments-resources
 resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
-  name: '46d3xbcp.network-frontdoorwebappfirewallpolicy.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
+  name: '46d3xbcp.res.network-frontdoorwebappfwpolicy.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
   properties: {
     mode: 'Incremental'
     template: {
diff --git a/avm/res/network/front-door-web-application-firewall-policy/main.json b/avm/res/network/front-door-web-application-firewall-policy/main.json
index 6e27f2abbf..52958c1ef6 100644
--- a/avm/res/network/front-door-web-application-firewall-policy/main.json
+++ b/avm/res/network/front-door-web-application-firewall-policy/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "6149649967109808609"
+      "templateHash": "12441964439062961983"
     },
     "name": "Front Door Web Application Firewall (WAF) Policies",
     "description": "This module deploys a Front Door Web Application Firewall (WAF) Policy.",
@@ -247,7 +247,7 @@
       "condition": "[parameters('enableTelemetry')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2024-03-01",
-      "name": "[format('46d3xbcp.network-frontdoorwebappfirewallpolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+      "name": "[format('46d3xbcp.res.network-frontdoorwebappfwpolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
       "properties": {
         "mode": "Incremental",
         "template": {
diff --git a/avm/res/sql/server/ORPHANED.md b/avm/res/network/front-door/ORPHANED.md
similarity index 100%
rename from avm/res/sql/server/ORPHANED.md
rename to avm/res/network/front-door/ORPHANED.md
diff --git a/avm/res/network/front-door/README.md b/avm/res/network/front-door/README.md
index 7034920c85..1fc4d43721 100644
--- a/avm/res/network/front-door/README.md
+++ b/avm/res/network/front-door/README.md
@@ -1,5 +1,10 @@
 # Azure Front Doors `[Microsoft.Network/frontDoors]`
 
+> ⚠️THIS MODULE IS CURRENTLY ORPHANED.⚠️
+> 
+> - Only security and bug fixes are being handled by the AVM core team at present.
+> - If interested in becoming the module owner of this orphaned module (must be Microsoft FTE), please look for the related "orphaned module" GitHub issue [here](https://aka.ms/AVM/OrphanedModules)!
+
 This module deploys an Azure Front Door.
 
 ## Navigation
diff --git a/avm/res/network/network-watcher/README.md b/avm/res/network/network-watcher/README.md
index 73371d83de..a13c4ae45b 100644
--- a/avm/res/network/network-watcher/README.md
+++ b/avm/res/network/network-watcher/README.md
@@ -128,7 +128,7 @@ module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
             disable: false
             name: 'test-http-Bing'
             sources: [
-              'subnet-001(${resourceGroup.name})'
+              'subnet-001(<value>)'
             ]
             testConfigurations: [
               'HTTP Bing Test'
@@ -240,7 +240,7 @@ module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
               "disable": false,
               "name": "test-http-Bing",
               "sources": [
-                "subnet-001(${resourceGroup.name})"
+                "subnet-001(<value>)"
               ],
               "testConfigurations": [
                 "HTTP Bing Test"
@@ -366,7 +366,7 @@ module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
             disable: false
             name: 'test-http-Bing'
             sources: [
-              'subnet-001(${resourceGroup.name})'
+              'subnet-001(<value>)'
             ]
             testConfigurations: [
               'HTTP Bing Test'
@@ -459,7 +459,7 @@ module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
               "disable": false,
               "name": "test-http-Bing",
               "sources": [
-                "subnet-001(${resourceGroup.name})"
+                "subnet-001(<value>)"
               ],
               "testConfigurations": [
                 "HTTP Bing Test"
diff --git a/avm/res/network/private-endpoint/README.md b/avm/res/network/private-endpoint/README.md
index 502e8cf9a4..9aa9d1085e 100644
--- a/avm/res/network/private-endpoint/README.md
+++ b/avm/res/network/private-endpoint/README.md
@@ -1048,6 +1048,7 @@ Tags to be applied on all resources/resource groups in this deployment.
 | `groupId` | string | The group Id for the private endpoint Group. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the private endpoint. |
+| `networkInterfaceIds` | array | The IDs of the network interfaces associated with the private endpoint. |
 | `resourceGroupName` | string | The resource group the private endpoint was deployed into. |
 | `resourceId` | string | The resource ID of the private endpoint. |
 
diff --git a/avm/res/network/private-endpoint/main.bicep b/avm/res/network/private-endpoint/main.bicep
index 6bbf258a46..f30b4f59f6 100644
--- a/avm/res/network/private-endpoint/main.bicep
+++ b/avm/res/network/private-endpoint/main.bicep
@@ -180,6 +180,9 @@ output location string = privateEndpoint.location
 @description('The custom DNS configurations of the private endpoint.')
 output customDnsConfig customDnsConfigType = privateEndpoint.properties.customDnsConfigs
 
+@description('The IDs of the network interfaces associated with the private endpoint.')
+output networkInterfaceIds array = privateEndpoint.properties.networkInterfaces
+
 @description('The group Id for the private endpoint Group.')
 output groupId string = !empty(privateEndpoint.properties.manualPrivateLinkServiceConnections) && length(privateEndpoint.properties.manualPrivateLinkServiceConnections[0].properties.?groupIds) > 0
   ? privateEndpoint.properties.manualPrivateLinkServiceConnections[0].properties.?groupIds[0] ?? ''
diff --git a/avm/res/network/private-endpoint/main.json b/avm/res/network/private-endpoint/main.json
index 6d8b312287..f5b0f0a552 100644
--- a/avm/res/network/private-endpoint/main.json
+++ b/avm/res/network/private-endpoint/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "901557491249861564"
+      "templateHash": "890546444303772798"
     },
     "name": "Private Endpoints",
     "description": "This module deploys a Private Endpoint.",
@@ -689,6 +689,13 @@
       },
       "value": "[reference('privateEndpoint').customDnsConfigs]"
     },
+    "networkInterfaceIds": {
+      "type": "array",
+      "metadata": {
+        "description": "The IDs of the network interfaces associated with the private endpoint."
+      },
+      "value": "[reference('privateEndpoint').networkInterfaces]"
+    },
     "groupId": {
       "type": "string",
       "metadata": {
diff --git a/avm/res/network/virtual-hub/README.md b/avm/res/network/virtual-hub/README.md
index 9f6dc26af1..ba68607e76 100644
--- a/avm/res/network/virtual-hub/README.md
+++ b/avm/res/network/virtual-hub/README.md
@@ -18,7 +18,8 @@ If you are planning to deploy a Secure Virtual Hub (with an Azure Firewall integ
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Network/virtualHubs` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualHubs) |
 | `Microsoft.Network/virtualHubs/hubRouteTables` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-11-01/virtualHubs/hubRouteTables) |
-| `Microsoft.Network/virtualHubs/hubVirtualNetworkConnections` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-11-01/virtualHubs/hubVirtualNetworkConnections) |
+| `Microsoft.Network/virtualHubs/hubVirtualNetworkConnections` | [2024-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections) |
+| `Microsoft.Network/virtualHubs/routingIntent` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualHubs/routingIntent) |
 
 ## Usage examples
 
@@ -30,7 +31,8 @@ The following section provides usage examples for the module, which were used to
 
 - [Using only defaults](#example-1-using-only-defaults)
 - [Using large parameter set](#example-2-using-large-parameter-set)
-- [WAF-aligned](#example-3-waf-aligned)
+- [Using Routing Intent](#example-3-using-routing-intent)
+- [WAF-aligned](#example-4-waf-aligned)
 
 ### Example 1: _Using only defaults_
 
@@ -222,7 +224,121 @@ module virtualHub 'br/public:avm/res/network/virtual-hub:<version>' = {
 </details>
 <p>
 
-### Example 3: _WAF-aligned_
+### Example 3: _Using Routing Intent_
+
+This instance deploys the module the Virtual WAN hub with Routing Intent enabled; requires an existing Virtual Hub, as well the firewall Resource ID.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module virtualHub 'br/public:avm/res/network/virtual-hub:<version>' = {
+  name: 'virtualHubDeployment'
+  params: {
+    // Required parameters
+    addressPrefix: '10.10.0.0/23'
+    name: 'nvhrtint'
+    virtualWanId: '<virtualWanId>'
+    // Non-required parameters
+    azureFirewallResourceId: '<azureFirewallResourceId>'
+    hubRouteTables: []
+    hubRoutingPreference: 'ASPath'
+    hubVirtualNetworkConnections: [
+      {
+        name: 'connection1'
+        remoteVirtualNetworkId: '<remoteVirtualNetworkId>'
+        routingConfiguration: {}
+      }
+    ]
+    internetToFirewall: false
+    location: '<location>'
+    lock: {
+      kind: 'CanNotDelete'
+      name: 'myCustomLockName'
+    }
+    privateToFirewall: true
+    tags: {
+      Environment: 'Non-Prod'
+      'hidden-title': 'This is visible in the resource name'
+      Role: 'DeploymentValidation'
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "addressPrefix": {
+      "value": "10.10.0.0/23"
+    },
+    "name": {
+      "value": "nvhrtint"
+    },
+    "virtualWanId": {
+      "value": "<virtualWanId>"
+    },
+    // Non-required parameters
+    "azureFirewallResourceId": {
+      "value": "<azureFirewallResourceId>"
+    },
+    "hubRouteTables": {
+      "value": []
+    },
+    "hubRoutingPreference": {
+      "value": "ASPath"
+    },
+    "hubVirtualNetworkConnections": {
+      "value": [
+        {
+          "name": "connection1",
+          "remoteVirtualNetworkId": "<remoteVirtualNetworkId>",
+          "routingConfiguration": {}
+        }
+      ]
+    },
+    "internetToFirewall": {
+      "value": false
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "lock": {
+      "value": {
+        "kind": "CanNotDelete",
+        "name": "myCustomLockName"
+      }
+    },
+    "privateToFirewall": {
+      "value": true
+    },
+    "tags": {
+      "value": {
+        "Environment": "Non-Prod",
+        "hidden-title": "This is visible in the resource name",
+        "Role": "DeploymentValidation"
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 4: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
@@ -377,10 +493,12 @@ module virtualHub 'br/public:avm/res/network/virtual-hub:<version>' = {
 | [`hubRouteTables`](#parameter-hubroutetables) | array | Route tables to create for the virtual hub. |
 | [`hubRoutingPreference`](#parameter-hubroutingpreference) | string | The preferred routing preference for this virtual hub. |
 | [`hubVirtualNetworkConnections`](#parameter-hubvirtualnetworkconnections) | array | Virtual network connections to create for the virtual hub. |
+| [`internetToFirewall`](#parameter-internettofirewall) | bool | Configures Routing Intent to forward Internet traffic (0.0.0.0/0) to Azure Firewall. Default is true. |
 | [`location`](#parameter-location) | string | Location for all resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`p2SVpnGatewayId`](#parameter-p2svpngatewayid) | string | Resource ID of the Point-to-Site VPN Gateway to link to. |
 | [`preferredRoutingGateway`](#parameter-preferredroutinggateway) | string | The preferred routing gateway types. |
+| [`privateToFirewall`](#parameter-privatetofirewall) | bool | Configures Routing Intent to forward Private traffic (RFC 1918) to Azure Firewall. Default is true. |
 | [`routeTableRoutes`](#parameter-routetableroutes) | array | VirtualHub route tables. |
 | [`securityPartnerProviderId`](#parameter-securitypartnerproviderid) | string | ID of the Security Partner Provider to link to. |
 | [`securityProviderName`](#parameter-securityprovidername) | string | The Security Provider name. |
@@ -477,6 +595,14 @@ Virtual network connections to create for the virtual hub.
 - Type: array
 - Default: `[]`
 
+### Parameter: `internetToFirewall`
+
+Configures Routing Intent to forward Internet traffic (0.0.0.0/0) to Azure Firewall. Default is true.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
 ### Parameter: `location`
 
 Location for all resources.
@@ -546,6 +672,14 @@ The preferred routing gateway types.
   ]
   ```
 
+### Parameter: `privateToFirewall`
+
+Configures Routing Intent to forward Private traffic (RFC 1918) to Azure Firewall. Default is true.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
 ### Parameter: `routeTableRoutes`
 
 VirtualHub route tables.
diff --git a/avm/res/network/virtual-hub/hub-route-table/main.json b/avm/res/network/virtual-hub/hub-route-table/main.json
index d84fdbe0d2..574eb2230e 100644
--- a/avm/res/network/virtual-hub/hub-route-table/main.json
+++ b/avm/res/network/virtual-hub/hub-route-table/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "7178717349327479453"
+      "version": "0.29.47.4906",
+      "templateHash": "2767725465951482406"
     },
     "name": "Virtual Hub Route Tables",
     "description": "This module deploys a Virtual Hub Route Table.",
diff --git a/avm/res/network/virtual-hub/hub-routing-intent/README.md b/avm/res/network/virtual-hub/hub-routing-intent/README.md
new file mode 100644
index 0000000000..08eda721b6
--- /dev/null
+++ b/avm/res/network/virtual-hub/hub-routing-intent/README.md
@@ -0,0 +1,73 @@
+# Virtual Hub Routing Intent `[Microsoft.Network/virtualHubs]`
+
+This module configures Routing Intent for a Virtual Hub; this module requires an existing Virtual Hub, as well the firewall Resource ID.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+- [Notes](#Notes)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Network/virtualHubs/routingIntent` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualHubs/routingIntent) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`azureFirewallResourceId`](#parameter-azurefirewallresourceid) | string | Hub firewall Resource ID. |
+| [`internetToFirewall`](#parameter-internettofirewall) | bool | Configures Routing Intent to Forward Internet traffic to the firewall (0.0.0.0/0). |
+| [`privateToFirewall`](#parameter-privatetofirewall) | bool | Configures Routing Intent to forward Private traffic to the firewall (RFC1918). |
+| [`virtualHubName`](#parameter-virtualhubname) | string | Name of the Virtual Hub. |
+
+### Parameter: `azureFirewallResourceId`
+
+Hub firewall Resource ID.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `internetToFirewall`
+
+Configures Routing Intent to Forward Internet traffic to the firewall (0.0.0.0/0).
+
+- Required: Yes
+- Type: bool
+
+### Parameter: `privateToFirewall`
+
+Configures Routing Intent to forward Private traffic to the firewall (RFC1918).
+
+- Required: Yes
+- Type: bool
+
+### Parameter: `virtualHubName`
+
+Name of the Virtual Hub.
+
+- Required: Yes
+- Type: string
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the Routing Intent configuration. |
+| `resourceGroupName` | string | The resource group the Routing Intent configuration was deployed into. |
+| `resourceId` | string | The resource ID of the Routing Intent configuration. |
+
+## Notes
+
+The use of Routing Intent in a Virtual Hub requires the hub be made 'secure' by associating a firewall (to serve as the next-hop for the routing policy).
+
+The 'azureFirewall' parameter in Microsoft.Network/virtualHubs is *read-only*; in order to properly deploy a Virtual Hub using Routing Intent, the hub's Resource ID must first be passed to the firewall in order for it to be properly associated. In order for this resource to work properly, the resources need to be created in the following order:
+
+- **Virtual Hub**: Suggest minimal hub configuration; name/location/addressPrefix/virtualWan.id
+- **Firewall**: Including Virtual Hub Resource ID in the firewall configuration
+- **Virtual Hub**: Including all remaining parameters + Routing Intent
diff --git a/avm/res/network/virtual-hub/hub-routing-intent/main.bicep b/avm/res/network/virtual-hub/hub-routing-intent/main.bicep
new file mode 100644
index 0000000000..aed6123d50
--- /dev/null
+++ b/avm/res/network/virtual-hub/hub-routing-intent/main.bicep
@@ -0,0 +1,68 @@
+metadata name = 'Virtual Hub Routing Intent'
+metadata description = 'This module configures Routing Intent for a Virtual Hub; this module requires an existing Virtual Hub, as well the firewall Resource ID.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Required. Hub firewall Resource ID.')
+param azureFirewallResourceId string
+
+@description('Required. Name of the Virtual Hub.')
+param virtualHubName string
+
+@description('Required. Configures Routing Intent to forward Private traffic to the firewall (RFC1918).')
+param privateToFirewall bool
+
+@description('Required. Configures Routing Intent to Forward Internet traffic to the firewall (0.0.0.0/0).')
+param internetToFirewall bool
+
+resource virtualHub 'Microsoft.Network/virtualHubs@2022-11-01' existing = {
+  name: virtualHubName
+}
+
+resource routingIntent 'Microsoft.Network/virtualHubs/routingIntent@2023-11-01' = {
+  name: 'defaultRouteTable'
+  parent : virtualHub
+  properties: {
+    routingPolicies: (internetToFirewall == true && privateToFirewall == true) ? [
+      {
+        name: '_policy_PublicTraffic'
+        destinations: [
+          'Internet'
+        ]
+        nextHop: azureFirewallResourceId
+      }
+      {
+        name: '_policy_PrivateTraffic'
+        destinations: [
+          'PrivateTraffic'
+        ]
+        nextHop: azureFirewallResourceId
+      }
+    ] : (internetToFirewall == true && privateToFirewall == false) ? [
+      {
+        name: '_policy_PublicTraffic'
+        destinations: [
+          'Internet'
+        ]
+        nextHop: azureFirewallResourceId
+      }
+    ] : (internetToFirewall == false && privateToFirewall == true) ? [
+      {
+        name: '_policy_PrivateTraffic'
+        destinations: [
+          'PrivateTraffic'
+        ]
+        nextHop: azureFirewallResourceId
+      }
+    ]
+  : null
+  }
+}
+
+@description('The name of the Routing Intent configuration.')
+output name string = routingIntent.name
+
+@description('The resource ID of the Routing Intent configuration.')
+output resourceId string = routingIntent.id
+
+@description('The resource group the Routing Intent configuration was deployed into.')
+output resourceGroupName string = resourceGroup().name
diff --git a/avm/res/network/virtual-hub/hub-routing-intent/main.json b/avm/res/network/virtual-hub/hub-routing-intent/main.json
new file mode 100644
index 0000000000..f540aae020
--- /dev/null
+++ b/avm/res/network/virtual-hub/hub-routing-intent/main.json
@@ -0,0 +1,73 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.29.47.4906",
+      "templateHash": "9080948373192033748"
+    },
+    "name": "Virtual Hub Routing Intent",
+    "description": "This module configures Routing Intent for a Virtual Hub; this module requires an existing Virtual Hub, as well the firewall Resource ID.",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "azureFirewallResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Hub firewall Resource ID."
+      }
+    },
+    "virtualHubName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Name of the Virtual Hub."
+      }
+    },
+    "privateToFirewall": {
+      "type": "bool",
+      "metadata": {
+        "description": "Required. Configures Routing Intent to forward Private traffic to the firewall (RFC1918)."
+      }
+    },
+    "internetToFirewall": {
+      "type": "bool",
+      "metadata": {
+        "description": "Required. Configures Routing Intent to Forward Internet traffic to the firewall (0.0.0.0/0)."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Network/virtualHubs/routingIntent",
+      "apiVersion": "2023-11-01",
+      "name": "[format('{0}/{1}', parameters('virtualHubName'), 'defaultRouteTable')]",
+      "properties": {
+        "routingPolicies": "[if(and(equals(parameters('internetToFirewall'), true()), equals(parameters('privateToFirewall'), true())), createArray(createObject('name', '_policy_PublicTraffic', 'destinations', createArray('Internet'), 'nextHop', parameters('azureFirewallResourceId')), createObject('name', '_policy_PrivateTraffic', 'destinations', createArray('PrivateTraffic'), 'nextHop', parameters('azureFirewallResourceId'))), if(and(equals(parameters('internetToFirewall'), true()), equals(parameters('privateToFirewall'), false())), createArray(createObject('name', '_policy_PublicTraffic', 'destinations', createArray('Internet'), 'nextHop', parameters('azureFirewallResourceId'))), if(and(equals(parameters('internetToFirewall'), false()), equals(parameters('privateToFirewall'), true())), createArray(createObject('name', '_policy_PrivateTraffic', 'destinations', createArray('PrivateTraffic'), 'nextHop', parameters('azureFirewallResourceId'))), null())))]"
+      }
+    }
+  ],
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Routing Intent configuration."
+      },
+      "value": "defaultRouteTable"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Routing Intent configuration."
+      },
+      "value": "[resourceId('Microsoft.Network/virtualHubs/routingIntent', parameters('virtualHubName'), 'defaultRouteTable')]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group the Routing Intent configuration was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/network/virtual-hub/hub-virtual-network-connection/README.md b/avm/res/network/virtual-hub/hub-virtual-network-connection/README.md
index 019aed305e..256ef324ed 100644
--- a/avm/res/network/virtual-hub/hub-virtual-network-connection/README.md
+++ b/avm/res/network/virtual-hub/hub-virtual-network-connection/README.md
@@ -12,7 +12,7 @@ This module deploys a Virtual Hub Virtual Network Connection.
 
 | Resource Type | API Version |
 | :-- | :-- |
-| `Microsoft.Network/virtualHubs/hubVirtualNetworkConnections` | [2022-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-11-01/virtualHubs/hubVirtualNetworkConnections) |
+| `Microsoft.Network/virtualHubs/hubVirtualNetworkConnections` | [2024-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections) |
 
 ## Parameters
 
diff --git a/avm/res/network/virtual-hub/hub-virtual-network-connection/main.bicep b/avm/res/network/virtual-hub/hub-virtual-network-connection/main.bicep
index f9751898ec..0dadaaf142 100644
--- a/avm/res/network/virtual-hub/hub-virtual-network-connection/main.bicep
+++ b/avm/res/network/virtual-hub/hub-virtual-network-connection/main.bicep
@@ -17,11 +17,11 @@ param remoteVirtualNetworkId string
 @description('Optional. Routing Configuration indicating the associated and propagated route tables for this connection.')
 param routingConfiguration object = {}
 
-resource virtualHub 'Microsoft.Network/virtualHubs@2022-11-01' existing = {
+resource virtualHub 'Microsoft.Network/virtualHubs@2024-01-01' existing = {
   name: virtualHubName
 }
 
-resource hubVirtualNetworkConnection 'Microsoft.Network/virtualHubs/hubVirtualNetworkConnections@2022-11-01' = {
+resource hubVirtualNetworkConnection 'Microsoft.Network/virtualHubs/hubVirtualNetworkConnections@2024-01-01' = {
   name: name
   parent: virtualHub
   properties: {
diff --git a/avm/res/network/virtual-hub/hub-virtual-network-connection/main.json b/avm/res/network/virtual-hub/hub-virtual-network-connection/main.json
index 83f863e837..ac1b70d82e 100644
--- a/avm/res/network/virtual-hub/hub-virtual-network-connection/main.json
+++ b/avm/res/network/virtual-hub/hub-virtual-network-connection/main.json
@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "3505452198428635330"
+      "version": "0.29.47.4906",
+      "templateHash": "12641692391238745355"
     },
     "name": "Virtual Hub Virtual Network Connections",
     "description": "This module deploys a Virtual Hub Virtual Network Connection.",
@@ -48,7 +48,7 @@
   "resources": [
     {
       "type": "Microsoft.Network/virtualHubs/hubVirtualNetworkConnections",
-      "apiVersion": "2022-11-01",
+      "apiVersion": "2024-01-01",
       "name": "[format('{0}/{1}', parameters('virtualHubName'), parameters('name'))]",
       "properties": {
         "enableInternetSecurity": "[parameters('enableInternetSecurity')]",
diff --git a/avm/res/network/virtual-hub/main.bicep b/avm/res/network/virtual-hub/main.bicep
index ae570f0f50..c21158f265 100644
--- a/avm/res/network/virtual-hub/main.bicep
+++ b/avm/res/network/virtual-hub/main.bicep
@@ -76,6 +76,12 @@ param virtualWanId string
 @description('Optional. Resource ID of the VPN Gateway to link to.')
 param vpnGatewayId string = ''
 
+@description('Optional. Configures Routing Intent to forward Internet traffic (0.0.0.0/0) to Azure Firewall. Default is true.')
+param internetToFirewall bool = true
+
+@description('Optional. Configures Routing Intent to forward Private traffic (RFC 1918) to Azure Firewall. Default is true.')
+param privateToFirewall bool = true
+
 @description('Optional. Route tables to create for the virtual hub.')
 param hubRouteTables array = []
 
@@ -171,8 +177,18 @@ resource virtualHub_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty
   scope: virtualHub
 }
 
+module virtualHub_routingIntent 'hub-routing-intent/main.bicep' = if (!empty(azureFirewallResourceId) && (internetToFirewall || privateToFirewall)) {
+  name: '${uniqueString(deployment().name, location)}-routingIntent'
+  params: {
+    virtualHubName: virtualHub.name
+    azureFirewallResourceId: azureFirewallResourceId
+    internetToFirewall: internetToFirewall
+    privateToFirewall: privateToFirewall
+  }
+}
+
 module virtualHub_routeTables 'hub-route-table/main.bicep' = [
-  for (routeTable, index) in hubRouteTables: {
+  for (routeTable, index) in (hubRouteTables ?? []): {
     name: '${uniqueString(deployment().name, location)}-routeTable-${index}'
     params: {
       virtualHubName: virtualHub.name
diff --git a/avm/res/network/virtual-hub/main.json b/avm/res/network/virtual-hub/main.json
index 5404500f8e..036e31e882 100644
--- a/avm/res/network/virtual-hub/main.json
+++ b/avm/res/network/virtual-hub/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.28.1.47646",
-      "templateHash": "13594058281073706360"
+      "version": "0.29.47.4906",
+      "templateHash": "14437175207078546495"
     },
     "name": "Virtual Hubs",
     "description": "This module deploys a Virtual Hub.\nIf you are planning to deploy a Secure Virtual Hub (with an Azure Firewall integrated), please refer to the Azure Firewall module.",
@@ -186,6 +186,20 @@
         "description": "Optional. Resource ID of the VPN Gateway to link to."
       }
     },
+    "internetToFirewall": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Configures Routing Intent to forward Internet traffic (0.0.0.0/0) to Azure Firewall. Default is true."
+      }
+    },
+    "privateToFirewall": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Configures Routing Intent to forward Private traffic (RFC 1918) to Azure Firewall. Default is true."
+      }
+    },
     "hubRouteTables": {
       "type": "array",
       "defaultValue": [],
@@ -276,10 +290,112 @@
         "virtualHub"
       ]
     },
+    "virtualHub_routingIntent": {
+      "condition": "[and(not(empty(parameters('azureFirewallResourceId'))), or(parameters('internetToFirewall'), parameters('privateToFirewall')))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-routingIntent', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "virtualHubName": {
+            "value": "[parameters('name')]"
+          },
+          "azureFirewallResourceId": {
+            "value": "[parameters('azureFirewallResourceId')]"
+          },
+          "internetToFirewall": {
+            "value": "[parameters('internetToFirewall')]"
+          },
+          "privateToFirewall": {
+            "value": "[parameters('privateToFirewall')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "9080948373192033748"
+            },
+            "name": "Virtual Hub Routing Intent",
+            "description": "This module configures Routing Intent for a Virtual Hub; this module requires an existing Virtual Hub, as well the firewall Resource ID.",
+            "owner": "Azure/module-maintainers"
+          },
+          "parameters": {
+            "azureFirewallResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Hub firewall Resource ID."
+              }
+            },
+            "virtualHubName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the Virtual Hub."
+              }
+            },
+            "privateToFirewall": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Configures Routing Intent to forward Private traffic to the firewall (RFC1918)."
+              }
+            },
+            "internetToFirewall": {
+              "type": "bool",
+              "metadata": {
+                "description": "Required. Configures Routing Intent to Forward Internet traffic to the firewall (0.0.0.0/0)."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Network/virtualHubs/routingIntent",
+              "apiVersion": "2023-11-01",
+              "name": "[format('{0}/{1}', parameters('virtualHubName'), 'defaultRouteTable')]",
+              "properties": {
+                "routingPolicies": "[if(and(equals(parameters('internetToFirewall'), true()), equals(parameters('privateToFirewall'), true())), createArray(createObject('name', '_policy_PublicTraffic', 'destinations', createArray('Internet'), 'nextHop', parameters('azureFirewallResourceId')), createObject('name', '_policy_PrivateTraffic', 'destinations', createArray('PrivateTraffic'), 'nextHop', parameters('azureFirewallResourceId'))), if(and(equals(parameters('internetToFirewall'), true()), equals(parameters('privateToFirewall'), false())), createArray(createObject('name', '_policy_PublicTraffic', 'destinations', createArray('Internet'), 'nextHop', parameters('azureFirewallResourceId'))), if(and(equals(parameters('internetToFirewall'), false()), equals(parameters('privateToFirewall'), true())), createArray(createObject('name', '_policy_PrivateTraffic', 'destinations', createArray('PrivateTraffic'), 'nextHop', parameters('azureFirewallResourceId'))), null())))]"
+              }
+            }
+          ],
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the Routing Intent configuration."
+              },
+              "value": "defaultRouteTable"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Routing Intent configuration."
+              },
+              "value": "[resourceId('Microsoft.Network/virtualHubs/routingIntent', parameters('virtualHubName'), 'defaultRouteTable')]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the Routing Intent configuration was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualHub"
+      ]
+    },
     "virtualHub_routeTables": {
       "copy": {
         "name": "virtualHub_routeTables",
-        "count": "[length(parameters('hubRouteTables'))]"
+        "count": "[length(coalesce(parameters('hubRouteTables'), createArray()))]"
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
@@ -294,10 +410,10 @@
             "value": "[parameters('name')]"
           },
           "name": {
-            "value": "[parameters('hubRouteTables')[copyIndex()].name]"
+            "value": "[coalesce(parameters('hubRouteTables'), createArray())[copyIndex()].name]"
           },
-          "labels": "[if(contains(parameters('hubRouteTables')[copyIndex()], 'labels'), createObject('value', parameters('hubRouteTables')[copyIndex()].labels), createObject('value', createArray()))]",
-          "routes": "[if(contains(parameters('hubRouteTables')[copyIndex()], 'routes'), createObject('value', parameters('hubRouteTables')[copyIndex()].routes), createObject('value', createArray()))]"
+          "labels": "[if(contains(coalesce(parameters('hubRouteTables'), createArray())[copyIndex()], 'labels'), createObject('value', coalesce(parameters('hubRouteTables'), createArray())[copyIndex()].labels), createObject('value', createArray()))]",
+          "routes": "[if(contains(coalesce(parameters('hubRouteTables'), createArray())[copyIndex()], 'routes'), createObject('value', coalesce(parameters('hubRouteTables'), createArray())[copyIndex()].routes), createObject('value', createArray()))]"
         },
         "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -305,8 +421,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "7178717349327479453"
+              "version": "0.29.47.4906",
+              "templateHash": "2767725465951482406"
             },
             "name": "Virtual Hub Route Tables",
             "description": "This module deploys a Virtual Hub Route Table.",
@@ -412,8 +528,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.28.1.47646",
-              "templateHash": "3505452198428635330"
+              "version": "0.29.47.4906",
+              "templateHash": "12641692391238745355"
             },
             "name": "Virtual Hub Virtual Network Connections",
             "description": "This module deploys a Virtual Hub Virtual Network Connection.",
@@ -456,7 +572,7 @@
           "resources": [
             {
               "type": "Microsoft.Network/virtualHubs/hubVirtualNetworkConnections",
-              "apiVersion": "2022-11-01",
+              "apiVersion": "2024-01-01",
               "name": "[format('{0}/{1}', parameters('virtualHubName'), parameters('name'))]",
               "properties": {
                 "enableInternetSecurity": "[parameters('enableInternetSecurity')]",
diff --git a/avm/res/network/virtual-hub/tests/e2e/routing-intent/dependencies.bicep b/avm/res/network/virtual-hub/tests/e2e/routing-intent/dependencies.bicep
new file mode 100644
index 0000000000..39fc4c0351
--- /dev/null
+++ b/avm/res/network/virtual-hub/tests/e2e/routing-intent/dependencies.bicep
@@ -0,0 +1,81 @@
+@description('Required. The name of the Virtual WAN to create.')
+param virtualWANName string
+
+@description('Required. The name of the Virtual Hub to create.')
+param virtualHubName string
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+@description('Required. The name of the Azure Firewall to create.')
+param azureFirewallName string
+
+@description('Optional. The location to deploy resources to.')
+param location string = resourceGroup().location
+
+var addressPrefix = '10.0.0.0/16'
+
+resource virtualWan 'Microsoft.Network/virtualWans@2023-04-01' = {
+  name: virtualWANName
+  location: location
+}
+
+resource virtualHub 'Microsoft.Network/virtualHubs@2023-11-01' = {
+  name: virtualHubName
+  location: location
+  properties: {
+    addressPrefix: '10.10.0.0/23'
+    virtualWan: {
+      id: virtualWan.id
+    }
+  }
+}
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+        }
+      }
+    ]
+  }
+}
+
+resource azureFirewall 'Microsoft.Network/azureFirewalls@2023-04-01' = {
+  name: azureFirewallName
+  location: location
+  properties: {
+    sku: {
+      name: 'AZFW_Hub'
+      tier: 'Premium'
+    }
+    hubIPAddresses: {
+      publicIPs: {
+        count: 1
+      }
+    }
+    virtualHub: {
+      id: virtualHub.id
+    }
+  }
+}
+
+
+@description('The resource ID of the created Virtual WAN.')
+output virtualWANResourceId string = virtualWan.id
+
+@description('The resource ID of the created Virtual Network.')
+output virtualNetworkResourceId string = virtualNetwork.id
+
+@description('The resource ID of the created Azure Firewall')
+output azureFirewallResourceId string = azureFirewall.id
diff --git a/avm/res/network/virtual-hub/tests/e2e/routing-intent/main.test.bicep b/avm/res/network/virtual-hub/tests/e2e/routing-intent/main.test.bicep
new file mode 100644
index 0000000000..737caa3be1
--- /dev/null
+++ b/avm/res/network/virtual-hub/tests/e2e/routing-intent/main.test.bicep
@@ -0,0 +1,84 @@
+targetScope = 'subscription'
+
+metadata name = 'Using Routing Intent'
+metadata description = 'This instance deploys the module the Virtual WAN hub with Routing Intent enabled; requires an existing Virtual Hub, as well the firewall Resource ID.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-network.virtualHub-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'nvhrtint'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    virtualWANName: 'dep-${namePrefix}-vw-${serviceShort}'
+    virtualHubName: '${namePrefix}-${serviceShort}'
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    azureFirewallName: 'dep-${namePrefix}-azfw-${serviceShort}'
+    location: resourceLocation
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    dependsOn: [nestedDependencies]
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      location: resourceLocation
+      name: '${namePrefix}-${serviceShort}'
+      lock: {
+        kind: 'CanNotDelete'
+        name: 'myCustomLockName'
+      }
+      addressPrefix: '10.10.0.0/23'
+      virtualWanId: nestedDependencies.outputs.virtualWANResourceId
+      hubRouteTables: []
+      hubVirtualNetworkConnections: [
+        {
+          name: 'connection1'
+          remoteVirtualNetworkId: nestedDependencies.outputs.virtualNetworkResourceId
+          routingConfiguration: {}
+        }
+      ]
+      hubRoutingPreference: 'ASPath'
+      azureFirewallResourceId: nestedDependencies.outputs.azureFirewallResourceId
+      internetToFirewall: false
+      privateToFirewall: true
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
+      }
+    }
+  }
+]
diff --git a/avm/res/network/virtual-network/subnet/README.md b/avm/res/network/virtual-network/subnet/README.md
index b8eb795dcc..246833a9db 100644
--- a/avm/res/network/virtual-network/subnet/README.md
+++ b/avm/res/network/virtual-network/subnet/README.md
@@ -7,7 +7,6 @@ This module deploys a Virtual Network Subnet.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 - [Notes](#Notes)
 
 ## Resource Types
@@ -281,13 +280,6 @@ The service endpoints to enable on the subnet.
 | `subnetAddressPrefix` | string | The address prefix for the subnet. |
 | `subnetAddressPrefixes` | array | List of address prefixes for the subnet. |
 
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
-
 ## Notes
 
 The `privateEndpointNetworkPolicies` property must be set to disabled for subnets that contain private endpoints. It confirms that NSGs rules will not apply to private endpoints (currently not supported, [reference](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview#limitations)). Default Value when not specified is "Enabled".
diff --git a/avm/res/network/virtual-network/virtual-network-peering/README.md b/avm/res/network/virtual-network/virtual-network-peering/README.md
index 64080d0af1..d0f08669b2 100644
--- a/avm/res/network/virtual-network/virtual-network-peering/README.md
+++ b/avm/res/network/virtual-network/virtual-network-peering/README.md
@@ -7,7 +7,6 @@ This module deploys a Virtual Network Peering.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -110,9 +109,3 @@ If remote gateways can be used on this virtual network. If the flag is set to tr
 | `resourceGroupName` | string | The resource group the virtual network peering was deployed into. |
 | `resourceId` | string | The resource ID of the virtual network peering. |
 
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/operational-insights/workspace/README.md b/avm/res/operational-insights/workspace/README.md
index 362b525855..2290266bfb 100644
--- a/avm/res/operational-insights/workspace/README.md
+++ b/avm/res/operational-insights/workspace/README.md
@@ -187,6 +187,15 @@ module workspace 'br/public:avm/res/operational-insights/workspace:<version>' =
         storageAccountResourceId: '<storageAccountResourceId>'
         workspaceResourceId: '<workspaceResourceId>'
       }
+      {
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+          }
+        ]
+        name: 'sendingDiagnosticSettingsToSelf'
+        useThisWorkspace: true
+      }
     ]
     gallerySolutions: [
       {
@@ -325,7 +334,6 @@ module workspace 'br/public:avm/res/operational-insights/workspace:<version>' =
       'hidden-title': 'This is visible in the resource name'
       Role: 'DeploymentValidation'
     }
-    useDeployedWorkspaceForDiagnosticSettings: true
     useResourcePermissions: true
   }
 }
@@ -484,6 +492,15 @@ module workspace 'br/public:avm/res/operational-insights/workspace:<version>' =
           "name": "customSetting",
           "storageAccountResourceId": "<storageAccountResourceId>",
           "workspaceResourceId": "<workspaceResourceId>"
+        },
+        {
+          "metricCategories": [
+            {
+              "category": "AllMetrics"
+            }
+          ],
+          "name": "sendingDiagnosticSettingsToSelf",
+          "useThisWorkspace": true
         }
       ]
     },
@@ -646,9 +663,6 @@ module workspace 'br/public:avm/res/operational-insights/workspace:<version>' =
         "Role": "DeploymentValidation"
       }
     },
-    "useDeployedWorkspaceForDiagnosticSettings": {
-      "value": true
-    },
     "useResourcePermissions": {
       "value": true
     }
@@ -1724,7 +1738,6 @@ module workspace 'br/public:avm/res/operational-insights/workspace:<version>' =
 | [`storageInsightsConfigs`](#parameter-storageinsightsconfigs) | array | List of storage accounts to be read by the workspace. |
 | [`tables`](#parameter-tables) | array | LAW custom tables to be deployed. |
 | [`tags`](#parameter-tags) | object | Tags of the resource. |
-| [`useDeployedWorkspaceForDiagnosticSettings`](#parameter-usedeployedworkspacefordiagnosticsettings) | bool | Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. |
 | [`useResourcePermissions`](#parameter-useresourcepermissions) | bool | Set to 'true' to use resource or workspace permissions and 'false' (or leave empty) to require workspace permissions. |
 
 ### Parameter: `name`
@@ -1793,6 +1806,7 @@ The diagnostic settings of the service.
 | [`metricCategories`](#parameter-diagnosticsettingsmetriccategories) | array | The name of metrics that will be streamed. "allMetrics" includes all possible metrics for the resource. Set to `[]` to disable metric collection. |
 | [`name`](#parameter-diagnosticsettingsname) | string | The name of diagnostic setting. |
 | [`storageAccountResourceId`](#parameter-diagnosticsettingsstorageaccountresourceid) | string | Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
+| [`useThisWorkspace`](#parameter-diagnosticsettingsusethisworkspace) | bool | Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored. |
 | [`workspaceResourceId`](#parameter-diagnosticsettingsworkspaceresourceid) | string | Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
 
 ### Parameter: `diagnosticSettings.eventHubAuthorizationRuleResourceId`
@@ -1913,6 +1927,13 @@ Resource ID of the diagnostic storage account. For security reasons, it is recom
 - Required: No
 - Type: string
 
+### Parameter: `diagnosticSettings.useThisWorkspace`
+
+Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored.
+
+- Required: No
+- Type: bool
+
 ### Parameter: `diagnosticSettings.workspaceResourceId`
 
 Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
@@ -2211,14 +2232,6 @@ Tags of the resource.
 - Required: No
 - Type: object
 
-### Parameter: `useDeployedWorkspaceForDiagnosticSettings`
-
-Instead of using an external reference, use the deployed instance as the target for its diagnostic settings.
-
-- Required: No
-- Type: bool
-- Default: `False`
-
 ### Parameter: `useResourcePermissions`
 
 Set to 'true' to use resource or workspace permissions and 'false' (or leave empty) to require workspace permissions.
diff --git a/avm/res/operational-insights/workspace/main.bicep b/avm/res/operational-insights/workspace/main.bicep
index a9f1e5c922..4c6bd5e5a1 100644
--- a/avm/res/operational-insights/workspace/main.bicep
+++ b/avm/res/operational-insights/workspace/main.bicep
@@ -82,9 +82,6 @@ param useResourcePermissions bool = false
 @description('Optional. The diagnostic settings of the service.')
 param diagnosticSettings diagnosticSettingType
 
-@description('Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings.')
-param useDeployedWorkspaceForDiagnosticSettings bool = false
-
 @description('Optional. Indicates whether customer managed storage is mandatory for query management.')
 param forceCmkForQuery bool = true
 
@@ -212,7 +209,7 @@ resource logAnalyticsWorkspace_diagnosticSettings 'Microsoft.Insights/diagnostic
     name: diagnosticSetting.?name ?? '${name}-diagnosticSettings'
     properties: {
       storageAccountId: diagnosticSetting.?storageAccountResourceId
-      workspaceId: useDeployedWorkspaceForDiagnosticSettings
+      workspaceId: (diagnosticSetting.?useThisWorkspace ?? false)
         ? logAnalyticsWorkspace.id
         : diagnosticSetting.?workspaceResourceId
       eventHubAuthorizationRuleId: diagnosticSetting.?eventHubAuthorizationRuleResourceId
@@ -482,6 +479,9 @@ type diagnosticSettingType = {
   @description('Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type.')
   logAnalyticsDestinationType: ('Dedicated' | 'AzureDiagnostics' | null)?
 
+  @description('Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored.')
+  useThisWorkspace: bool?
+
   @description('Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.')
   workspaceResourceId: string?
 
diff --git a/avm/res/operational-insights/workspace/main.json b/avm/res/operational-insights/workspace/main.json
index 1e54043d68..ccbd83e3c1 100644
--- a/avm/res/operational-insights/workspace/main.json
+++ b/avm/res/operational-insights/workspace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "11421725796221742541"
+      "templateHash": "11994891550110156380"
     },
     "name": "Log Analytics Workspaces",
     "description": "This module deploys a Log Analytics Workspace.",
@@ -215,6 +215,13 @@
               "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
             }
           },
+          "useThisWorkspace": {
+            "type": "bool",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
+            }
+          },
           "workspaceResourceId": {
             "type": "string",
             "nullable": true,
@@ -409,13 +416,6 @@
         "description": "Optional. The diagnostic settings of the service."
       }
     },
-    "useDeployedWorkspaceForDiagnosticSettings": {
-      "type": "bool",
-      "defaultValue": false,
-      "metadata": {
-        "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings."
-      }
-    },
     "forceCmkForQuery": {
       "type": "bool",
       "defaultValue": true,
@@ -551,7 +551,7 @@
           }
         ],
         "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-        "workspaceId": "[if(parameters('useDeployedWorkspaceForDiagnosticSettings'), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
+        "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
         "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
         "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
         "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
diff --git a/avm/res/operational-insights/workspace/tests/e2e/adv/main.test.bicep b/avm/res/operational-insights/workspace/tests/e2e/adv/main.test.bicep
index e0025415db..94d627e6a7 100644
--- a/avm/res/operational-insights/workspace/tests/e2e/adv/main.test.bicep
+++ b/avm/res/operational-insights/workspace/tests/e2e/adv/main.test.bicep
@@ -174,8 +174,16 @@ module testDeployment '../../../main.bicep' = [
           storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
           workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
         }
+        {
+          name: 'sendingDiagnosticSettingsToSelf'
+          metricCategories: [
+            {
+              category: 'AllMetrics'
+            }
+          ]
+          useThisWorkspace: true
+        }
       ]
-      useDeployedWorkspaceForDiagnosticSettings: true
       gallerySolutions: [
         {
           name: 'AzureAutomation'
diff --git a/avm/res/operational-insights/workspace/version.json b/avm/res/operational-insights/workspace/version.json
index a8eda31021..e42c3d9e5f 100644
--- a/avm/res/operational-insights/workspace/version.json
+++ b/avm/res/operational-insights/workspace/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.5",
+    "version": "0.6",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/purview/account/README.md b/avm/res/purview/account/README.md
index 3732b6159b..34287538e1 100644
--- a/avm/res/purview/account/README.md
+++ b/avm/res/purview/account/README.md
@@ -105,9 +105,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     // Non-required parameters
     accountPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<purviewAccountPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'account'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -133,9 +137,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     ]
     eventHubPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<eventHubPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'namespace'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -158,9 +166,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     managedResourceGroupName: 'pvamax001-managed-rg'
     portalPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<purviewPortalPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'portal'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -170,9 +182,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<purviewPortalPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -198,9 +214,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     ]
     storageBlobPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<storageBlobPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -212,9 +232,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     ]
     storageQueuePrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<storageQueuePrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'queue'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -224,9 +248,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<storageQueuePrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -259,9 +287,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "accountPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<purviewAccountPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "account",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -291,9 +323,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "eventHubPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<eventHubPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "namespace",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -326,9 +362,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "portalPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<purviewPortalPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "portal",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -338,9 +378,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<purviewPortalPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -372,9 +416,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "storageBlobPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<storageBlobPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -388,9 +436,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "storageQueuePrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<storageQueuePrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "queue",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -400,9 +452,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<storageQueuePrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -439,9 +495,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     // Non-required parameters
     accountPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<purviewAccountPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'account'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -456,9 +516,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     ]
     eventHubPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<eventHubPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'namespace'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -467,9 +531,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     managedResourceGroupName: 'pvawaf001-managed-rg'
     portalPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<purviewPortalPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'portal'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -477,18 +545,26 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     publicNetworkAccess: 'Disabled'
     storageBlobPrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<storageBlobPrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
       }
     ]
     storageQueuePrivateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<storageQueuePrivateDNSResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'queue'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -522,9 +598,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "accountPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<purviewAccountPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "account",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -543,9 +623,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "eventHubPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<eventHubPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "namespace",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -560,9 +644,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "portalPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<purviewPortalPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "portal",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -574,9 +662,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "storageBlobPrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<storageBlobPrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -585,9 +677,13 @@ module account 'br/public:avm/res/purview/account:<version>' = {
     "storageQueuePrivateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<storageQueuePrivateDNSResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "queue",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -668,8 +764,7 @@ Configuration details for Purview Account private endpoints. For security reason
 | [`lock`](#parameter-accountprivateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-accountprivateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-accountprivateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-accountprivateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-accountprivateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-accountprivateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-accountprivateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-accountprivateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-accountprivateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -853,19 +948,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `accountPrivateEndpoints.privateDnsZoneGroupName`
+### Parameter: `accountPrivateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-accountprivateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-accountprivateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `accountPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-accountprivateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-accountprivateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `accountPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `accountPrivateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `accountPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `accountPrivateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `accountPrivateEndpoints.privateLinkServiceConnectionName`
 
@@ -1173,8 +1313,7 @@ Configuration details for Purview Managed Event Hub namespace private endpoints.
 | [`lock`](#parameter-eventhubprivateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-eventhubprivateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-eventhubprivateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-eventhubprivateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-eventhubprivateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-eventhubprivateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-eventhubprivateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-eventhubprivateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-eventhubprivateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1358,19 +1497,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `eventHubPrivateEndpoints.privateDnsZoneGroupName`
+### Parameter: `eventHubPrivateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-eventhubprivateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-eventhubprivateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `eventHubPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-eventhubprivateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-eventhubprivateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `eventHubPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `eventHubPrivateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `eventHubPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `eventHubPrivateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `eventHubPrivateEndpoints.privateLinkServiceConnectionName`
 
@@ -1596,8 +1780,7 @@ Configuration details for Purview Portal private endpoints. For security reasons
 | [`lock`](#parameter-portalprivateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-portalprivateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-portalprivateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-portalprivateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-portalprivateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-portalprivateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-portalprivateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-portalprivateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-portalprivateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1781,19 +1964,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `portalPrivateEndpoints.privateDnsZoneGroupName`
+### Parameter: `portalPrivateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-portalprivateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-portalprivateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `portalPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-portalprivateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-portalprivateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `portalPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `portalPrivateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `portalPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `portalPrivateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `portalPrivateEndpoints.privateLinkServiceConnectionName`
 
@@ -2060,8 +2288,7 @@ Configuration details for Purview Managed Storage Account blob private endpoints
 | [`lock`](#parameter-storageblobprivateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-storageblobprivateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-storageblobprivateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-storageblobprivateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-storageblobprivateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-storageblobprivateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-storageblobprivateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-storageblobprivateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-storageblobprivateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2245,19 +2472,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneGroupName`
+### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-storageblobprivateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-storageblobprivateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-storageblobprivateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-storageblobprivateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `storageBlobPrivateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `storageBlobPrivateEndpoints.privateLinkServiceConnectionName`
 
@@ -2411,8 +2683,7 @@ Configuration details for Purview Managed Storage Account queue private endpoint
 | [`lock`](#parameter-storagequeueprivateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-storagequeueprivateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-storagequeueprivateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-storagequeueprivateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-storagequeueprivateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-storagequeueprivateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-storagequeueprivateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-storagequeueprivateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-storagequeueprivateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2596,19 +2867,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneGroupName`
+### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-storagequeueprivateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-storagequeueprivateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-storagequeueprivateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-storagequeueprivateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `storageQueuePrivateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `storageQueuePrivateEndpoints.privateLinkServiceConnectionName`
 
@@ -2746,14 +3062,19 @@ Tags of the resource.
 
 | Output | Type | Description |
 | :-- | :-- | :-- |
+| `accountPrivateEndpoints` | array | The private endpoints of the Purview Account. |
+| `eventHubPrivateEndpoints` | array | The private endpoints of the managed Event Hub Namespace. |
 | `location` | string | The location the resource was deployed into. |
 | `managedEventHubId` | string | The resource ID of the managed Event Hub Namespace. |
 | `managedResourceGroupId` | string | The resource ID of the managed resource group. |
 | `managedResourceGroupName` | string | The name of the managed resource group. |
 | `managedStorageAccountId` | string | The resource ID of the managed storage account. |
 | `name` | string | The name of the Purview Account. |
+| `portalPrivateEndpoints` | array | The private endpoints of the Purview Account Portal. |
 | `resourceGroupName` | string | The resource group the Purview Account was deployed into. |
 | `resourceId` | string | The resource ID of the Purview Account. |
+| `storageBlobPrivateEndpoints` | array | The private endpoints of the managed storage account blob service. |
+| `storageQueuePrivateEndpoints` | array | The private endpoints of the managed storage account queue service. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
 
 ## Cross-referenced modules
@@ -2762,7 +3083,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/purview/account/main.bicep b/avm/res/purview/account/main.bicep
index d665e01bfa..392942cbf6 100644
--- a/avm/res/purview/account/main.bicep
+++ b/avm/res/purview/account/main.bicep
@@ -165,9 +165,9 @@ resource account_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-
   }
 ]
 
-module account_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module account_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (accountPrivateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-Account-PrivateEndpoint-${index}'
+    name: '${uniqueString(deployment().name, location)}-account-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
     params: {
       name: privateEndpoint.?name ?? 'pep-${last(split(account.id, '/'))}-${privateEndpoint.?service ?? 'account'}-${index}'
@@ -206,8 +206,7 @@ module account_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -218,9 +217,9 @@ module account_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.
   }
 ]
 
-module portal_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module portal_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (portalPrivateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-Portal-PrivateEndpoint-${index}'
+    name: '${uniqueString(deployment().name, location)}-portal-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
     params: {
       name: privateEndpoint.?name ?? 'pep-${last(split(account.id, '/'))}-${privateEndpoint.?service ?? 'portal'}-${index}'
@@ -259,8 +258,7 @@ module portal_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -271,9 +269,9 @@ module portal_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1
   }
 ]
 
-module blob_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module blob_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (storageBlobPrivateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-Storage-Blob-PrivateEndpoint-${index}'
+    name: '${uniqueString(deployment().name, location)}-blob-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
     params: {
       name: privateEndpoint.?name ?? 'pep-${last(split(account.id, '/'))}-${privateEndpoint.?service ?? 'blob'}-${index}'
@@ -312,8 +310,7 @@ module blob_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -324,9 +321,9 @@ module blob_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
   }
 ]
 
-module queue_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module queue_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (storageQueuePrivateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-Storage-Queue-PrivateEndpoint-${index}'
+    name: '${uniqueString(deployment().name, location)}-queue-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
     params: {
       name: privateEndpoint.?name ?? 'pep-${last(split(account.id, '/'))}-${privateEndpoint.?service ?? 'queue'}-${index}'
@@ -365,8 +362,7 @@ module queue_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -377,9 +373,9 @@ module queue_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
   }
 ]
 
-module eventHub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module eventHub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (eventHubPrivateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-Eventhub-Namespace-PrivateEndpoint-${index}'
+    name: '${uniqueString(deployment().name, location)}-eventHub-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
     params: {
       name: privateEndpoint.?name ?? 'pep-${last(split(account.id, '/'))}-${privateEndpoint.?service ?? 'namespace'}-${index}'
@@ -418,8 +414,7 @@ module eventHub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -473,6 +468,61 @@ output managedEventHubId string = account.properties.managedResources.eventHubNa
 @description('The principal ID of the system assigned identity.')
 output systemAssignedMIPrincipalId string = account.?identity.?principalId ?? ''
 
+@description('The private endpoints of the Purview Account.')
+output accountPrivateEndpoints array = [
+  for (pe, i) in (!empty(accountPrivateEndpoints) ? array(accountPrivateEndpoints) : []): {
+    name: account_privateEndpoints[i].outputs.name
+    resourceId: account_privateEndpoints[i].outputs.resourceId
+    groupId: account_privateEndpoints[i].outputs.groupId
+    customDnsConfig: account_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: account_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('The private endpoints of the Purview Account Portal.')
+output portalPrivateEndpoints array = [
+  for (pe, i) in (!empty(portalPrivateEndpoints) ? array(portalPrivateEndpoints) : []): {
+    name: portal_privateEndpoints[i].outputs.name
+    resourceId: portal_privateEndpoints[i].outputs.resourceId
+    groupId: portal_privateEndpoints[i].outputs.groupId
+    customDnsConfig: portal_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: portal_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('The private endpoints of the managed storage account blob service.')
+output storageBlobPrivateEndpoints array = [
+  for (pe, i) in (!empty(storageBlobPrivateEndpoints) ? array(storageBlobPrivateEndpoints) : []): {
+    name: blob_privateEndpoints[i].outputs.name
+    resourceId: blob_privateEndpoints[i].outputs.resourceId
+    groupId: blob_privateEndpoints[i].outputs.groupId
+    customDnsConfig: blob_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: blob_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('The private endpoints of the managed storage account queue service.')
+output storageQueuePrivateEndpoints array = [
+  for (pe, i) in (!empty(storageQueuePrivateEndpoints) ? array(storageQueuePrivateEndpoints) : []): {
+    name: queue_privateEndpoints[i].outputs.name
+    resourceId: queue_privateEndpoints[i].outputs.resourceId
+    groupId: queue_privateEndpoints[i].outputs.groupId
+    customDnsConfig: queue_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: queue_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('The private endpoints of the managed Event Hub Namespace.')
+output eventHubPrivateEndpoints array = [
+  for (pe, i) in (!empty(eventHubPrivateEndpoints) ? array(eventHubPrivateEndpoints) : []): {
+    name: eventHub_privateEndpoints[i].outputs.name
+    resourceId: eventHub_privateEndpoints[i].outputs.resourceId
+    groupId: eventHub_privateEndpoints[i].outputs.groupId
+    customDnsConfig: eventHub_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: eventHub_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -570,18 +620,26 @@ type privateEndpointType = {
   @description('Optional. The name of the private link connection to create.')
   privateLinkServiceConnectionName: string?
 
-  // Variant 1: A default service can be assumed (i.e., for services that only have one private endpoint type)
   @description('Optional. The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory".')
   service: string?
 
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/purview/account/main.json b/avm/res/purview/account/main.json
index d7e0b0c0ad..f4cf2712e1 100644
--- a/avm/res/purview/account/main.json
+++ b/avm/res/purview/account/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "8913927126760967534"
+      "templateHash": "15039051778035234501"
     },
     "name": "Purview Accounts",
     "description": "This module deploys a Purview Account.",
@@ -285,21 +285,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -687,7 +710,7 @@
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-Account-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "name": "[format('{0}-account-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
       "resourceGroup": "[coalesce(tryGet(coalesce(parameters('accountPrivateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
       "properties": {
         "expressionEvaluationOptions": {
@@ -712,11 +735,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('accountPrivateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('accountPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('accountPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('accountPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('accountPrivateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -745,13 +765,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1003,6 +1044,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1038,18 +1102,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1130,7 +1187,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1209,7 +1266,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1220,28 +1277,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1249,12 +1330,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1268,27 +1352,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1355,6 +1448,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1376,7 +1476,7 @@
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-Portal-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "name": "[format('{0}-portal-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
       "resourceGroup": "[coalesce(tryGet(coalesce(parameters('portalPrivateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
       "properties": {
         "expressionEvaluationOptions": {
@@ -1401,11 +1501,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('portalPrivateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('portalPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('portalPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('portalPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('portalPrivateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1434,13 +1531,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1692,6 +1810,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1727,18 +1868,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1819,7 +1953,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1898,7 +2032,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1909,28 +2043,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1938,12 +2096,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1957,27 +2118,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2044,6 +2214,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2065,7 +2242,7 @@
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-Storage-Blob-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "name": "[format('{0}-blob-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
       "resourceGroup": "[coalesce(tryGet(coalesce(parameters('storageBlobPrivateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
       "properties": {
         "expressionEvaluationOptions": {
@@ -2090,11 +2267,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('storageBlobPrivateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('storageBlobPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('storageBlobPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('storageBlobPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('storageBlobPrivateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -2123,13 +2297,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -2381,6 +2576,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2416,18 +2634,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2508,7 +2719,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2587,7 +2798,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2598,28 +2809,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2627,12 +2862,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2646,27 +2884,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2733,6 +2980,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2754,7 +3008,7 @@
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-Storage-Queue-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "name": "[format('{0}-queue-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
       "resourceGroup": "[coalesce(tryGet(coalesce(parameters('storageQueuePrivateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
       "properties": {
         "expressionEvaluationOptions": {
@@ -2779,11 +3033,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('storageQueuePrivateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('storageQueuePrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('storageQueuePrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('storageQueuePrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('storageQueuePrivateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -2812,13 +3063,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -3070,6 +3342,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -3105,18 +3400,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -3197,7 +3485,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -3276,7 +3564,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -3287,28 +3575,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -3316,12 +3628,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -3335,27 +3650,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -3422,6 +3746,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -3443,7 +3774,7 @@
       },
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2022-09-01",
-      "name": "[format('{0}-Eventhub-Namespace-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "name": "[format('{0}-eventHub-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
       "resourceGroup": "[coalesce(tryGet(coalesce(parameters('eventHubPrivateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
       "properties": {
         "expressionEvaluationOptions": {
@@ -3468,11 +3799,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('eventHubPrivateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('eventHubPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('eventHubPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('eventHubPrivateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('eventHubPrivateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -3501,13 +3829,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -3759,6 +4108,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -3794,18 +4166,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -3886,7 +4251,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -3965,7 +4330,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -3976,28 +4341,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -4005,12 +4394,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -4024,27 +4416,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -4111,6 +4512,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -4189,6 +4597,86 @@
         "description": "The principal ID of the system assigned identity."
       },
       "value": "[coalesce(tryGet(tryGet(reference('account', '2021-07-01', 'full'), 'identity'), 'principalId'), '')]"
+    },
+    "accountPrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Purview Account."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('accountPrivateEndpoints'))), array(parameters('accountPrivateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('account_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('account_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('account_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('account_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('account_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "portalPrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Purview Account Portal."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('portalPrivateEndpoints'))), array(parameters('portalPrivateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('portal_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('portal_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('portal_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('portal_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('portal_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "storageBlobPrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the managed storage account blob service."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('storageBlobPrivateEndpoints'))), array(parameters('storageBlobPrivateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('blob_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('blob_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('blob_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('blob_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('blob_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "storageQueuePrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the managed storage account queue service."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('storageQueuePrivateEndpoints'))), array(parameters('storageQueuePrivateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('queue_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('queue_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('queue_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('queue_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('queue_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "eventHubPrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the managed Event Hub Namespace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('eventHubPrivateEndpoints'))), array(parameters('eventHubPrivateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('eventHub_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('eventHub_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('eventHub_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('eventHub_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('eventHub_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/purview/account/tests/e2e/max/main.test.bicep b/avm/res/purview/account/tests/e2e/max/main.test.bicep
index 0b544313e3..d50eef4117 100644
--- a/avm/res/purview/account/tests/e2e/max/main.test.bicep
+++ b/avm/res/purview/account/tests/e2e/max/main.test.bicep
@@ -121,9 +121,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       accountPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.purviewAccountPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.purviewAccountPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'account'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
@@ -135,9 +139,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       portalPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.purviewPortalPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.purviewPortalPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'portal'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
@@ -147,17 +155,25 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.purviewPortalPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.purviewPortalPrivateDNSResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
       storageBlobPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.storageBlobPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.storageBlobPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
@@ -169,9 +185,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       storageQueuePrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.storageQueuePrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.storageQueuePrivateDNSResourceId
+              }
+            ]
+          }
           service: 'queue'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
@@ -181,17 +201,25 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.storageQueuePrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.storageQueuePrivateDNSResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
       eventHubPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.eventHubPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.eventHubPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'namespace'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/purview/account/tests/e2e/waf-aligned/main.test.bicep b/avm/res/purview/account/tests/e2e/waf-aligned/main.test.bicep
index d39ad0c684..dbf48b0d92 100644
--- a/avm/res/purview/account/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/purview/account/tests/e2e/waf-aligned/main.test.bicep
@@ -87,45 +87,65 @@ module testDeployment '../../../main.bicep' = [
       ]
       accountPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.purviewAccountPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.purviewAccountPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'account'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
       portalPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.purviewPortalPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.purviewPortalPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'portal'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
       storageBlobPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.storageBlobPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.storageBlobPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
       storageQueuePrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.storageQueuePrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.storageQueuePrivateDNSResourceId
+              }
+            ]
+          }
           service: 'queue'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
       eventHubPrivateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.eventHubPrivateDNSResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.eventHubPrivateDNSResourceId
+              }
+            ]
+          }
           service: 'namespace'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
diff --git a/avm/res/purview/account/version.json b/avm/res/purview/account/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/purview/account/version.json
+++ b/avm/res/purview/account/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/recovery-services/vault/README.md b/avm/res/recovery-services/vault/README.md
index fe86146167..b6ca61f7e5 100644
--- a/avm/res/recovery-services/vault/README.md
+++ b/avm/res/recovery-services/vault/README.md
@@ -626,9 +626,13 @@ module vault 'br/public:avm/res/recovery-services/vault:<version>' = {
             }
           }
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -1026,9 +1030,13 @@ module vault 'br/public:avm/res/recovery-services/vault:<version>' = {
               }
             }
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -1420,9 +1428,13 @@ module vault 'br/public:avm/res/recovery-services/vault:<version>' = {
             }
           }
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -1801,9 +1813,13 @@ module vault 'br/public:avm/res/recovery-services/vault:<version>' = {
               }
             }
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -2166,8 +2182,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2351,19 +2366,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -2655,6 +2715,7 @@ Tags of the Recovery Service Vault resource.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The Name of the recovery services vault. |
+| `privateEndpoints` | array | The private endpoints of the recovery services vault. |
 | `resourceGroupName` | string | The name of the resource group the recovery services vault was created in. |
 | `resourceId` | string | The resource ID of the recovery services vault. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -2665,7 +2726,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/recovery-services/vault/main.bicep b/avm/res/recovery-services/vault/main.bicep
index 3814977dbc..5ee99722fa 100644
--- a/avm/res/recovery-services/vault/main.bicep
+++ b/avm/res/recovery-services/vault/main.bicep
@@ -313,7 +313,7 @@ resource rsv_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-0
   }
 ]
 
-module rsv_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module rsv_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-rsv-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -354,8 +354,7 @@ module rsv_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' =
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -397,6 +396,17 @@ output systemAssignedMIPrincipalId string = rsv.?identity.?principalId ?? ''
 @description('The location the resource was deployed into.')
 output location string = rsv.location
 
+@description('The private endpoints of the recovery services vault.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: rsv_privateEndpoints[i].outputs.name
+    resourceId: rsv_privateEndpoints[i].outputs.resourceId
+    groupId: rsv_privateEndpoints[i].outputs.groupId
+    customDnsConfig: rsv_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: rsv_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -459,11 +469,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/recovery-services/vault/main.json b/avm/res/recovery-services/vault/main.json
index a45d01f251..91ffe8c500 100644
--- a/avm/res/recovery-services/vault/main.json
+++ b/avm/res/recovery-services/vault/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "9430653726515425544"
+      "templateHash": "1317340221517130136"
     },
     "name": "Recovery Services Vaults",
     "description": "This module deploys a Recovery Services Vault.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -2060,11 +2083,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -2093,13 +2113,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -2351,6 +2392,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2386,18 +2450,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2478,7 +2535,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2557,7 +2614,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2568,28 +2625,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2597,12 +2678,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2616,27 +2700,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2703,6 +2796,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2753,6 +2853,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('rsv', '2023-01-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the recovery services vault."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('rsv_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('rsv_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('rsv_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('rsv_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('rsv_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/recovery-services/vault/tests/e2e/max/main.test.bicep b/avm/res/recovery-services/vault/tests/e2e/max/main.test.bicep
index 13411c7ff9..28e3b85435 100644
--- a/avm/res/recovery-services/vault/tests/e2e/max/main.test.bicep
+++ b/avm/res/recovery-services/vault/tests/e2e/max/main.test.bicep
@@ -380,9 +380,13 @@ module testDeployment '../../../main.bicep' = [
               }
             }
           ]
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
diff --git a/avm/res/recovery-services/vault/tests/e2e/waf-aligned/main.test.bicep b/avm/res/recovery-services/vault/tests/e2e/waf-aligned/main.test.bicep
index 925915c278..7ad49f1ccb 100644
--- a/avm/res/recovery-services/vault/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/recovery-services/vault/tests/e2e/waf-aligned/main.test.bicep
@@ -380,9 +380,13 @@ module testDeployment '../../../main.bicep' = [
               }
             }
           ]
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
diff --git a/avm/res/recovery-services/vault/version.json b/avm/res/recovery-services/vault/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/recovery-services/vault/version.json
+++ b/avm/res/recovery-services/vault/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/relay/namespace/README.md b/avm/res/relay/namespace/README.md
index fd65b26921..837fa1fa43 100644
--- a/avm/res/relay/namespace/README.md
+++ b/avm/res/relay/namespace/README.md
@@ -182,9 +182,13 @@ module namespace 'br/public:avm/res/relay/namespace:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'namespace'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -194,9 +198,13 @@ module namespace 'br/public:avm/res/relay/namespace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -345,9 +353,13 @@ module namespace 'br/public:avm/res/relay/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "namespace",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -357,9 +369,13 @@ module namespace 'br/public:avm/res/relay/namespace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -489,9 +505,13 @@ module namespace 'br/public:avm/res/relay/namespace:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'namespace'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -600,9 +620,13 @@ module namespace 'br/public:avm/res/relay/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "namespace",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -928,8 +952,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1113,19 +1136,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1384,6 +1452,7 @@ The wcf relays to create in the relay namespace.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed relay namespace. |
+| `privateEndpoints` | array | The private endpoints of the relay namespace. |
 | `resourceGroupName` | string | The resource group of the deployed relay namespace. |
 | `resourceId` | string | The resource ID of the deployed relay namespace. |
 
@@ -1393,7 +1462,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/relay/namespace/main.bicep b/avm/res/relay/namespace/main.bicep
index a9ec9ccd00..e28a037e51 100644
--- a/avm/res/relay/namespace/main.bicep
+++ b/avm/res/relay/namespace/main.bicep
@@ -264,7 +264,7 @@ resource namespace_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@202
   }
 ]
 
-module namespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module namespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-namespace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -305,8 +305,7 @@ module namespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -345,6 +344,17 @@ output name string = namespace.name
 @description('The location the resource was deployed into.')
 output location string = namespace.location
 
+@description('The private endpoints of the relay namespace.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: namespace_privateEndpoints[i].outputs.name
+    resourceId: namespace_privateEndpoints[i].outputs.resourceId
+    groupId: namespace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: namespace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: namespace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -399,11 +409,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/relay/namespace/main.json b/avm/res/relay/namespace/main.json
index 83e1158785..66c0fbf16e 100644
--- a/avm/res/relay/namespace/main.json
+++ b/avm/res/relay/namespace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13811660507923080890"
+      "templateHash": "10535689791446770792"
     },
     "name": "Relay Namespaces",
     "description": "This module deploys a Relay Namespace",
@@ -150,21 +150,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -1788,11 +1811,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1821,13 +1841,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -2079,6 +2120,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2114,18 +2178,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2206,7 +2263,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2285,7 +2342,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2296,28 +2353,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2325,12 +2406,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2344,27 +2428,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2431,6 +2524,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2474,6 +2574,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('namespace', '2021-11-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the relay namespace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('namespace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/relay/namespace/tests/e2e/max/main.test.bicep b/avm/res/relay/namespace/tests/e2e/max/main.test.bicep
index bcbcb125c7..687c8e3487 100644
--- a/avm/res/relay/namespace/tests/e2e/max/main.test.bicep
+++ b/avm/res/relay/namespace/tests/e2e/max/main.test.bicep
@@ -182,9 +182,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'namespace'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -193,9 +197,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
     }
diff --git a/avm/res/relay/namespace/tests/e2e/waf-aligned/main.test.bicep b/avm/res/relay/namespace/tests/e2e/waf-aligned/main.test.bicep
index 4d8538975c..99ae681c88 100644
--- a/avm/res/relay/namespace/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/relay/namespace/tests/e2e/waf-aligned/main.test.bicep
@@ -134,9 +134,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'namespace'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
diff --git a/avm/res/relay/namespace/version.json b/avm/res/relay/namespace/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/relay/namespace/version.json
+++ b/avm/res/relay/namespace/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/relay/namespace/wcf-relay/authorization-rule/README.md b/avm/res/relay/namespace/wcf-relay/authorization-rule/README.md
index 5ebcb14382..0402ca48c9 100644
--- a/avm/res/relay/namespace/wcf-relay/authorization-rule/README.md
+++ b/avm/res/relay/namespace/wcf-relay/authorization-rule/README.md
@@ -7,7 +7,6 @@ This module deploys a WCF Relay Authorization Rule.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -80,10 +79,3 @@ The rights associated with the rule.
 | `name` | string | The name of the authorization rule. |
 | `resourceGroupName` | string | The name of the Resource Group the authorization rule was created in. |
 | `resourceId` | string | The Resource ID of the authorization rule. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/resources/deployment-script/README.md b/avm/res/resources/deployment-script/README.md
index 05e5d379d6..9dac2f308c 100644
--- a/avm/res/resources/deployment-script/README.md
+++ b/avm/res/resources/deployment-script/README.md
@@ -52,14 +52,12 @@ module deploymentScript 'br/public:avm/res/resources/deployment-script:<version>
     name: 'rdscli001'
     // Non-required parameters
     azCliVersion: '2.9.1'
-    environmentVariables: {
-      secureList: [
-        {
-          name: 'var1'
-          value: 'AVM Deployment Script test!'
-        }
-      ]
-    }
+    environmentVariables: [
+      {
+        name: 'var1'
+        value: 'AVM Deployment Script test!'
+      }
+    ]
     location: '<location>'
     managedIdentities: {
       userAssignedResourcesIds: [
@@ -97,14 +95,12 @@ module deploymentScript 'br/public:avm/res/resources/deployment-script:<version>
       "value": "2.9.1"
     },
     "environmentVariables": {
-      "value": {
-        "secureList": [
-          {
-            "name": "var1",
-            "value": "AVM Deployment Script test!"
-          }
-        ]
-      }
+      "value": [
+        {
+          "name": "var1",
+          "value": "AVM Deployment Script test!"
+        }
+      ]
     },
     "location": {
       "value": "<location>"
@@ -225,18 +221,16 @@ module deploymentScript 'br/public:avm/res/resources/deployment-script:<version>
     azCliVersion: '2.9.1'
     cleanupPreference: 'Always'
     containerGroupName: 'dep-cg-rdsmax'
-    environmentVariables: {
-      secureList: [
-        {
-          name: 'var1'
-          value: 'test'
-        }
-        {
-          name: 'var2'
-          secureValue: '<secureValue>'
-        }
-      ]
-    }
+    environmentVariables: [
+      {
+        name: 'var1'
+        value: 'test'
+      }
+      {
+        name: 'var2'
+        secureValue: '<secureValue>'
+      }
+    ]
     location: '<location>'
     lock: {
       kind: 'None'
@@ -312,18 +306,16 @@ module deploymentScript 'br/public:avm/res/resources/deployment-script:<version>
       "value": "dep-cg-rdsmax"
     },
     "environmentVariables": {
-      "value": {
-        "secureList": [
-          {
-            "name": "var1",
-            "value": "test"
-          },
-          {
-            "name": "var2",
-            "secureValue": "<secureValue>"
-          }
-        ]
-      }
+      "value": [
+        {
+          "name": "var1",
+          "value": "test"
+        },
+        {
+          "name": "var2",
+          "secureValue": "<secureValue>"
+        }
+      ]
     },
     "location": {
       "value": "<location>"
@@ -805,7 +797,7 @@ module deploymentScript 'br/public:avm/res/resources/deployment-script:<version>
 | [`cleanupPreference`](#parameter-cleanuppreference) | string | The clean up preference when the script execution gets in a terminal state. Specify the preference on when to delete the deployment script resources. The default value is Always, which means the deployment script resources are deleted despite the terminal state (Succeeded, Failed, canceled). |
 | [`containerGroupName`](#parameter-containergroupname) | string | Container group name, if not specified then the name will get auto-generated. Not specifying a 'containerGroupName' indicates the system to generate a unique name which might end up flagging an Azure Policy as non-compliant. Use 'containerGroupName' when you have an Azure Policy that expects a specific naming convention or when you want to fully control the name. 'containerGroupName' property must be between 1 and 63 characters long, must contain only lowercase letters, numbers, and dashes and it cannot start or end with a dash and consecutive dashes are not allowed. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
-| [`environmentVariables`](#parameter-environmentvariables) | secureObject | The environment variables to pass over to the script. The list is passed as an object with a key name "secureList" and the value is the list of environment variables (array). The list must have a 'name' and a 'value' or a 'secretValue' property for each object. |
+| [`environmentVariables`](#parameter-environmentvariables) | array | The environment variables to pass over to the script. |
 | [`location`](#parameter-location) | string | Location for all resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. |
@@ -901,10 +893,39 @@ Enable/Disable usage telemetry for module.
 
 ### Parameter: `environmentVariables`
 
-The environment variables to pass over to the script. The list is passed as an object with a key name "secureList" and the value is the list of environment variables (array). The list must have a 'name' and a 'value' or a 'secretValue' property for each object.
+The environment variables to pass over to the script.
 
 - Required: No
-- Type: secureObject
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-environmentvariablesname) | string | The name of the environment variable. |
+| [`secureValue`](#parameter-environmentvariablessecurevalue) | securestring | The value of the secure environment variable. |
+| [`value`](#parameter-environmentvariablesvalue) | string | The value of the environment variable. |
+
+### Parameter: `environmentVariables.name`
+
+The name of the environment variable.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `environmentVariables.secureValue`
+
+The value of the secure environment variable.
+
+- Required: No
+- Type: securestring
+
+### Parameter: `environmentVariables.value`
+
+The value of the environment variable.
+
+- Required: No
+- Type: string
 
 ### Parameter: `location`
 
diff --git a/avm/res/resources/deployment-script/main.bicep b/avm/res/resources/deployment-script/main.bicep
index dc7f75fddc..55dc0612e2 100644
--- a/avm/res/resources/deployment-script/main.bicep
+++ b/avm/res/resources/deployment-script/main.bicep
@@ -37,8 +37,8 @@ param scriptContent string?
 @description('Optional. Uri for the external script. This is the entry point for the external script. To run an internal script, use the scriptContent parameter instead.')
 param primaryScriptUri string?
 
-@description('Optional. The environment variables to pass over to the script. The list is passed as an object with a key name "secureList" and the value is the list of environment variables (array). The list must have a \'name\' and a \'value\' or a \'secretValue\' property for each object.')
-param environmentVariables environmentVariableType
+@description('Optional. The environment variables to pass over to the script.')
+param environmentVariables environmentVariableType[]?
 
 @description('Optional. List of supporting files for the external script (defined in primaryScriptUri). Does not work with internal scripts (code defined in scriptContent).')
 param supportingScriptUris array?
@@ -187,7 +187,7 @@ resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
     containerSettings: !empty(containerSettings) ? containerSettings : null
     storageAccountSettings: !empty(storageAccountResourceId) ? storageAccountSettings : null
     arguments: arguments
-    environmentVariables: environmentVariables != null ? environmentVariables!.secureList : []
+    environmentVariables: environmentVariables
     scriptContent: !empty(scriptContent) ? scriptContent : null
     primaryScriptUri: !empty(primaryScriptUri) ? primaryScriptUri : null
     supportingScriptUris: !empty(supportingScriptUris) ? supportingScriptUris : null
@@ -247,7 +247,7 @@ output name string = deploymentScript.name
 output location string = deploymentScript.location
 
 @description('The output of the deployment script.')
-output outputs object = contains(deploymentScript.properties, 'outputs') ? deploymentScript.properties.outputs : {}
+output outputs object = deploymentScript.properties.?outputs ?? {}
 
 @description('The logs of the deployment script.')
 output deploymentScriptLogs string[] = split(deploymentScriptLogs.properties.log, '\n')
@@ -295,12 +295,14 @@ type roleAssignmentType = {
   delegatedManagedIdentityResourceId: string?
 }[]?
 
-@secure()
 type environmentVariableType = {
-  @description('Optional. The list of environment variables to pass over to the deployment script.')
-  secureList: {
-    name: string
-    secureValue: string?
-    value: string?
-  }[]
-}?
+  @description('Required. The name of the environment variable.')
+  name: string
+
+  @description('Required. The value of the secure environment variable.')
+  @secure()
+  secureValue: string?
+
+  @description('Required. The value of the environment variable.')
+  value: string?
+}
diff --git a/avm/res/resources/deployment-script/main.json b/avm/res/resources/deployment-script/main.json
index 59d0dbc0ec..96f10eba58 100644
--- a/avm/res/resources/deployment-script/main.json
+++ b/avm/res/resources/deployment-script/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "5318642198380728784"
+      "templateHash": "11095024633645020544"
     },
     "name": "Deployment Scripts",
     "description": "This module deploys Deployment Scripts.",
@@ -127,32 +127,29 @@
       "nullable": true
     },
     "environmentVariableType": {
-      "type": "secureObject",
+      "type": "object",
       "properties": {
-        "secureList": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              },
-              "secureValue": {
-                "type": "string",
-                "nullable": true
-              },
-              "value": {
-                "type": "string",
-                "nullable": true
-              }
-            }
-          },
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name of the environment variable."
+          }
+        },
+        "secureValue": {
+          "type": "securestring",
+          "nullable": true,
           "metadata": {
-            "description": "Optional. The list of environment variables to pass over to the deployment script."
+            "description": "Required. The value of the secure environment variable."
+          }
+        },
+        "value": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Required. The value of the environment variable."
           }
         }
-      },
-      "nullable": true
+      }
     }
   },
   "parameters": {
@@ -222,9 +219,13 @@
       }
     },
     "environmentVariables": {
-      "$ref": "#/definitions/environmentVariableType",
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/environmentVariableType"
+      },
+      "nullable": true,
       "metadata": {
-        "description": "Optional. The environment variables to pass over to the script. The list is passed as an object with a key name \"secureList\" and the value is the list of environment variables (array). The list must have a 'name' and a 'value' or a 'secretValue' property for each object."
+        "description": "Optional. The environment variables to pass over to the script."
       }
     },
     "supportingScriptUris": {
@@ -398,7 +399,7 @@
         "containerSettings": "[if(not(empty(variables('containerSettings'))), variables('containerSettings'), null())]",
         "storageAccountSettings": "[if(not(empty(parameters('storageAccountResourceId'))), if(not(empty(parameters('storageAccountResourceId'))), createObject('storageAccountKey', if(empty(parameters('subnetResourceIds')), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), '//'), '/')[2], split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), '////'), '/')[4]), 'Microsoft.Storage/storageAccounts', last(split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), 'dummyAccount'), '/'))), '2023-01-01').keys[0].value, null()), 'storageAccountName', last(split(parameters('storageAccountResourceId'), '/'))), null()), null())]",
         "arguments": "[parameters('arguments')]",
-        "environmentVariables": "[if(not(equals(parameters('environmentVariables'), null())), parameters('environmentVariables').secureList, createArray())]",
+        "environmentVariables": "[parameters('environmentVariables')]",
         "scriptContent": "[if(not(empty(parameters('scriptContent'))), parameters('scriptContent'), null())]",
         "primaryScriptUri": "[if(not(empty(parameters('primaryScriptUri'))), parameters('primaryScriptUri'), null())]",
         "supportingScriptUris": "[if(not(empty(parameters('supportingScriptUris'))), parameters('supportingScriptUris'), null())]",
@@ -491,7 +492,7 @@
       "metadata": {
         "description": "The output of the deployment script."
       },
-      "value": "[if(contains(reference('deploymentScript'), 'outputs'), reference('deploymentScript').outputs, createObject())]"
+      "value": "[coalesce(tryGet(reference('deploymentScript'), 'outputs'), createObject())]"
     },
     "deploymentScriptLogs": {
       "type": "array",
diff --git a/avm/res/resources/deployment-script/tests/e2e/cli/main.test.bicep b/avm/res/resources/deployment-script/tests/e2e/cli/main.test.bicep
index f2dc7b05ae..461b6f0409 100644
--- a/avm/res/resources/deployment-script/tests/e2e/cli/main.test.bicep
+++ b/avm/res/resources/deployment-script/tests/e2e/cli/main.test.bicep
@@ -54,14 +54,12 @@ module testDeployment '../../../main.bicep' = {
     azCliVersion: '2.9.1'
     kind: 'AzureCLI'
     retentionInterval: 'P1D'
-    environmentVariables: {
-      secureList: [
-        {
-          name: 'var1'
-          value: 'AVM Deployment Script test!'
-        }
-      ]
-    }
+    environmentVariables: [
+      {
+        name: 'var1'
+        value: 'AVM Deployment Script test!'
+      }
+    ]
     scriptContent: 'echo \'Enviornment variable value is: \' $var1'
     storageAccountResourceId: nestedDependencies.outputs.storageAccountResourceId
     managedIdentities: {
diff --git a/avm/res/resources/deployment-script/tests/e2e/max/main.test.bicep b/avm/res/resources/deployment-script/tests/e2e/max/main.test.bicep
index df07edf439..5311631d44 100644
--- a/avm/res/resources/deployment-script/tests/e2e/max/main.test.bicep
+++ b/avm/res/resources/deployment-script/tests/e2e/max/main.test.bicep
@@ -65,18 +65,16 @@ module testDeployment '../../../main.bicep' = {
     }
     containerGroupName: 'dep-${namePrefix}-cg-${serviceShort}'
     arguments: '-argument1 \\"test\\"'
-    environmentVariables: {
-      secureList: [
-        {
-          name: 'var1'
-          value: 'test'
-        }
-        {
-          name: 'var2'
-          secureValue: guid(deployment().name)
-        }
-      ]
-    }
+    environmentVariables: [
+      {
+        name: 'var1'
+        value: 'test'
+      }
+      {
+        name: 'var2'
+        secureValue: guid(deployment().name)
+      }
+    ]
     managedIdentities: {
       userAssignedResourcesIds: [
         nestedDependencies.outputs.managedIdentityResourceId
diff --git a/avm/res/search/search-service/README.md b/avm/res/search/search-service/README.md
index 08e95aef8e..a0de84e740 100644
--- a/avm/res/search/search-service/README.md
+++ b/avm/res/search/search-service/README.md
@@ -322,9 +322,13 @@ module searchService 'br/public:avm/res/search/search-service:<version>' = {
         applicationSecurityGroupResourceIds: [
           '<applicationSecurityGroupResourceId>'
         ]
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -332,13 +336,17 @@ module searchService 'br/public:avm/res/search/search-service:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
-    publicNetworkAccess: 'disabled'
+    publicNetworkAccess: 'Disabled'
     sharedPrivateLinkResources: [
       {
         groupId: 'blob'
@@ -387,9 +395,13 @@ module searchService 'br/public:avm/res/search/search-service:<version>' = {
           "applicationSecurityGroupResourceIds": [
             "<applicationSecurityGroupResourceId>"
           ],
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -397,15 +409,19 @@ module searchService 'br/public:avm/res/search/search-service:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
     },
     "publicNetworkAccess": {
-      "value": "disabled"
+      "value": "Disabled"
     },
     "sharedPrivateLinkResources": {
       "value": [
@@ -626,7 +642,7 @@ module searchService 'br/public:avm/res/search/search-service:<version>' = {
 | [`networkRuleSet`](#parameter-networkruleset) | object | Network specific rules that determine how the Azure Cognitive Search service may be reached. |
 | [`partitionCount`](#parameter-partitioncount) | int | The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3. |
 | [`privateEndpoints`](#parameter-privateendpoints) | array | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. |
-| [`publicNetworkAccess`](#parameter-publicnetworkaccess) | string | This value can be set to 'enabled' to avoid breaking changes on existing customer resources and templates. If set to 'disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method. |
+| [`publicNetworkAccess`](#parameter-publicnetworkaccess) | string | This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method. |
 | [`replicaCount`](#parameter-replicacount) | int | The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU. |
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
 | [`semanticSearch`](#parameter-semanticsearch) | string | Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations. |
@@ -957,8 +973,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1142,19 +1157,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1283,16 +1343,16 @@ Tags to be applied on all resources/resource groups in this deployment.
 
 ### Parameter: `publicNetworkAccess`
 
-This value can be set to 'enabled' to avoid breaking changes on existing customer resources and templates. If set to 'disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method.
+This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method.
 
 - Required: No
 - Type: string
-- Default: `'enabled'`
+- Default: `'Enabled'`
 - Allowed:
   ```Bicep
   [
-    'disabled'
-    'enabled'
+    'Disabled'
+    'Enabled'
   ]
   ```
 
@@ -1457,6 +1517,7 @@ Tags to help categorize the resource in the Azure portal.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the search service. |
+| `privateEndpoints` | array | The private endpoints of the search service. |
 | `resourceGroupName` | string | The name of the resource group the search service was created in. |
 | `resourceId` | string | The resource ID of the search service. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1467,7 +1528,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/search/search-service/main.bicep b/avm/res/search/search-service/main.bicep
index 2aca3b421e..bc455a8f68 100644
--- a/avm/res/search/search-service/main.bicep
+++ b/avm/res/search/search-service/main.bicep
@@ -53,12 +53,12 @@ param privateEndpoints privateEndpointType
 @description('Optional. The sharedPrivateLinkResources to create as part of the search Service.')
 param sharedPrivateLinkResources array = []
 
-@description('Optional. This value can be set to \'enabled\' to avoid breaking changes on existing customer resources and templates. If set to \'disabled\', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method.')
+@description('Optional. This value can be set to \'Enabled\' to avoid breaking changes on existing customer resources and templates. If set to \'Disabled\', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method.')
 @allowed([
-  'enabled'
-  'disabled'
+  'Enabled'
+  'Disabled'
 ])
-param publicNetworkAccess string = 'enabled'
+param publicNetworkAccess string = 'Enabled'
 
 @description('Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU.')
 @minValue(1)
@@ -158,7 +158,7 @@ var formattedRoleAssignments = [
 
 #disable-next-line no-deployments-resources
 resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
-  name: '46d3xbcp.search-searchservice.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
+  name: '46d3xbcp.res.search-searchservice.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
   properties: {
     mode: 'Incremental'
     template: {
@@ -193,7 +193,7 @@ resource searchService 'Microsoft.Search/searchServices@2024-03-01-preview' = {
     networkRuleSet: networkRuleSet
     partitionCount: partitionCount
     replicaCount: replicaCount
-    publicNetworkAccess: publicNetworkAccess
+    publicNetworkAccess: toLower(publicNetworkAccess)
     semanticSearch: semanticSearch
   }
 }
@@ -254,7 +254,7 @@ resource searchService_roleAssignments 'Microsoft.Authorization/roleAssignments@
   }
 ]
 
-module searchService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module searchService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-searchService-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -295,8 +295,7 @@ module searchService_privateEndpoints 'br/public:avm/res/network/private-endpoin
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -315,9 +314,7 @@ module searchService_sharedPrivateLinkResources 'shared-private-link-resource/ma
   for (sharedPrivateLinkResource, index) in sharedPrivateLinkResources: {
     name: '${uniqueString(deployment().name, location)}-searchService-SharedPrivateLink-${index}'
     params: {
-      name: contains(sharedPrivateLinkResource, 'name')
-        ? sharedPrivateLinkResource.name
-        : 'spl-${last(split(searchService.id, '/'))}-${sharedPrivateLinkResource.groupId}-${index}'
+      name: sharedPrivateLinkResource.?name ?? 'spl-${last(split(searchService.id, '/'))}-${sharedPrivateLinkResource.groupId}-${index}'
       searchServiceName: searchService.name
       privateLinkResourceId: sharedPrivateLinkResource.privateLinkResourceId
       groupId: sharedPrivateLinkResource.groupId
@@ -346,6 +343,17 @@ output systemAssignedMIPrincipalId string = searchService.?identity.?principalId
 @description('The location the resource was deployed into.')
 output location string = searchService.location
 
+@description('The private endpoints of the search service.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: searchService_privateEndpoints[i].outputs.name
+    resourceId: searchService_privateEndpoints[i].outputs.resourceId
+    groupId: searchService_privateEndpoints[i].outputs.groupId
+    customDnsConfig: searchService_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: searchService_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -408,11 +416,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/search/search-service/main.json b/avm/res/search/search-service/main.json
index baa40b9b9c..04beacbf9e 100644
--- a/avm/res/search/search-service/main.json
+++ b/avm/res/search/search-service/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "15785260316401338655"
+      "templateHash": "10051405020131908010"
     },
     "name": "Search Services",
     "description": "This module deploys a Search Service.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -547,13 +570,13 @@
     },
     "publicNetworkAccess": {
       "type": "string",
-      "defaultValue": "enabled",
+      "defaultValue": "Enabled",
       "allowedValues": [
-        "enabled",
-        "disabled"
+        "Enabled",
+        "Disabled"
       ],
       "metadata": {
-        "description": "Optional. This value can be set to 'enabled' to avoid breaking changes on existing customer resources and templates. If set to 'disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method."
+        "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method."
       }
     },
     "replicaCount": {
@@ -645,7 +668,7 @@
       "condition": "[parameters('enableTelemetry')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2024-03-01",
-      "name": "[format('46d3xbcp.search-searchservice.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+      "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
       "properties": {
         "mode": "Incremental",
         "template": {
@@ -681,7 +704,7 @@
         "networkRuleSet": "[parameters('networkRuleSet')]",
         "partitionCount": "[parameters('partitionCount')]",
         "replicaCount": "[parameters('replicaCount')]",
-        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+        "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]",
         "semanticSearch": "[parameters('semanticSearch')]"
       }
     },
@@ -794,11 +817,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -827,13 +847,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1085,6 +1126,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1120,18 +1184,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1212,7 +1269,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1291,7 +1348,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1302,28 +1359,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1331,12 +1412,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1350,27 +1434,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1437,6 +1530,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1467,7 +1567,9 @@
         },
         "mode": "Incremental",
         "parameters": {
-          "name": "[if(contains(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), createObject('value', parameters('sharedPrivateLinkResources')[copyIndex()].name), createObject('value', format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex())))]",
+          "name": {
+            "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]"
+          },
           "searchServiceName": {
             "value": "[parameters('name')]"
           },
@@ -1624,6 +1726,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('searchService', '2024-03-01-preview', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the search service."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/search/search-service/tests/e2e/defaults/main.test.bicep b/avm/res/search/search-service/tests/e2e/defaults/main.test.bicep
index 46be064fce..dd0fc6e895 100644
--- a/avm/res/search/search-service/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/search/search-service/tests/e2e/defaults/main.test.bicep
@@ -35,11 +35,14 @@ resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
 // Test Execution //
 // ============== //
 
-module testDeployment '../../../main.bicep' = {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
-  params: {
-    name: '${namePrefix}${serviceShort}002'
-    location: resourceLocation
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}002'
+      location: resourceLocation
+    }
   }
-}
+]
diff --git a/avm/res/search/search-service/tests/e2e/max/main.test.bicep b/avm/res/search/search-service/tests/e2e/max/main.test.bicep
index 809de28e64..0fc341ea23 100644
--- a/avm/res/search/search-service/tests/e2e/max/main.test.bicep
+++ b/avm/res/search/search-service/tests/e2e/max/main.test.bicep
@@ -58,88 +58,91 @@ module diagnosticDependencies '../../../../../../utilities/e2e-template-assets/t
 // Test Execution //
 // ============== //
 
-module testDeployment '../../../main.bicep' = {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
-  params: {
-    name: '${namePrefix}${serviceShort}001'
-    location: resourceLocation
-    sku: 'standard3'
-    cmkEnforcement: 'Enabled'
-    disableLocalAuth: false
-    authOptions: {
-      aadOrApiKey: {
-        aadAuthFailureMode: 'http401WithBearerChallenge'
-      }
-    }
-    hostingMode: 'highDensity'
-    partitionCount: 2
-    replicaCount: 3
-    semanticSearch: 'standard'
-    managedIdentities: {
-      systemAssigned: true
-      userAssignedResourceIds: [
-        nestedDependencies.outputs.managedIdentityResourceId
-      ]
-    }
-    lock: {
-      kind: 'CanNotDelete'
-      name: 'myCustomLockName'
-    }
-    roleAssignments: [
-      {
-        name: '73ec30e0-2e25-475f-beec-d90cab332eb7'
-        roleDefinitionIdOrName: 'Owner'
-        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
-        principalType: 'ServicePrincipal'
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      sku: 'standard3'
+      cmkEnforcement: 'Enabled'
+      disableLocalAuth: false
+      authOptions: {
+        aadOrApiKey: {
+          aadAuthFailureMode: 'http401WithBearerChallenge'
+        }
       }
-      {
-        name: guid('Custom seed ${namePrefix}${serviceShort}')
-        roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
-        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
-        principalType: 'ServicePrincipal'
+      hostingMode: 'highDensity'
+      partitionCount: 2
+      replicaCount: 3
+      semanticSearch: 'standard'
+      managedIdentities: {
+        systemAssigned: true
+        userAssignedResourceIds: [
+          nestedDependencies.outputs.managedIdentityResourceId
+        ]
       }
-      {
-        roleDefinitionIdOrName: subscriptionResourceId(
-          'Microsoft.Authorization/roleDefinitions',
-          'acdd72a7-3385-48ef-bd42-f606fba81ae7'
-        )
-        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
-        principalType: 'ServicePrincipal'
+      lock: {
+        kind: 'CanNotDelete'
+        name: 'myCustomLockName'
       }
-    ]
-    networkRuleSet: {
-      ipRules: [
+      roleAssignments: [
         {
-          value: '40.74.28.0/23'
+          name: '73ec30e0-2e25-475f-beec-d90cab332eb7'
+          roleDefinitionIdOrName: 'Owner'
+          principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+          principalType: 'ServicePrincipal'
         }
         {
-          value: '87.147.204.13'
+          name: guid('Custom seed ${namePrefix}${serviceShort}')
+          roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
+          principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+          principalType: 'ServicePrincipal'
+        }
+        {
+          roleDefinitionIdOrName: subscriptionResourceId(
+            'Microsoft.Authorization/roleDefinitions',
+            'acdd72a7-3385-48ef-bd42-f606fba81ae7'
+          )
+          principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+          principalType: 'ServicePrincipal'
         }
       ]
-    }
-    diagnosticSettings: [
-      {
-        name: 'customSetting'
-        metricCategories: [
+      networkRuleSet: {
+        ipRules: [
+          {
+            value: '40.74.28.0/23'
+          }
           {
-            category: 'AllMetrics'
+            value: '87.147.204.13'
           }
         ]
-        eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
-        eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
-        storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
-        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
       }
-    ]
-    tags: {
-      'hidden-title': 'This is visible in the resource name'
-      Environment: 'Non-Prod'
-      Role: 'DeploymentValidation'
+      diagnosticSettings: [
+        {
+          name: 'customSetting'
+          metricCategories: [
+            {
+              category: 'AllMetrics'
+            }
+          ]
+          eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
+          eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
+          storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
+          workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+        }
+      ]
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
+      }
     }
+    dependsOn: [
+      nestedDependencies
+      diagnosticDependencies
+    ]
   }
-  dependsOn: [
-    nestedDependencies
-    diagnosticDependencies
-  ]
-}
+]
diff --git a/avm/res/search/search-service/tests/e2e/pe/main.test.bicep b/avm/res/search/search-service/tests/e2e/pe/main.test.bicep
index 1743c384cc..185cd85d5f 100644
--- a/avm/res/search/search-service/tests/e2e/pe/main.test.bicep
+++ b/avm/res/search/search-service/tests/e2e/pe/main.test.bicep
@@ -48,54 +48,65 @@ module nestedDependencies 'dependencies.bicep' = {
 // Test Execution //
 // ============== //
 
-module testDeployment '../../../main.bicep' = {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
-  params: {
-    name: '${namePrefix}${serviceShort}001'
-    location: resourceLocation
-    publicNetworkAccess: 'disabled'
-    privateEndpoints: [
-      {
-        applicationSecurityGroupResourceIds: [
-          nestedDependencies.outputs.applicationSecurityGroupResourceId
-        ]
-        privateDnsZoneResourceIds: [
-          nestedDependencies.outputs.privateDNSZoneResourceId
-        ]
-        subnetResourceId: nestedDependencies.outputs.subnetResourceId
-        tags: {
-          Environment: 'Non-Prod'
-          Role: 'DeploymentValidation'
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      publicNetworkAccess: 'Disabled'
+      privateEndpoints: [
+        {
+          applicationSecurityGroupResourceIds: [
+            nestedDependencies.outputs.applicationSecurityGroupResourceId
+          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
+          subnetResourceId: nestedDependencies.outputs.subnetResourceId
+          tags: {
+            Environment: 'Non-Prod'
+            Role: 'DeploymentValidation'
+          }
         }
+        {
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
+          subnetResourceId: nestedDependencies.outputs.subnetResourceId
+        }
+      ]
+      sharedPrivateLinkResources: [
+        {
+          privateLinkResourceId: nestedDependencies.outputs.storageAccountResourceId
+          groupId: 'blob'
+          resourceRegion: nestedDependencies.outputs.storageAccountLocation
+          requestMessage: 'Please approve this request'
+        }
+        {
+          privateLinkResourceId: nestedDependencies.outputs.keyVaultResourceId
+          groupId: 'vault'
+          requestMessage: 'Please approve this request'
+        }
+      ]
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
       }
-      {
-        privateDnsZoneResourceIds: [
-          nestedDependencies.outputs.privateDNSZoneResourceId
-        ]
-        subnetResourceId: nestedDependencies.outputs.subnetResourceId
-      }
-    ]
-    sharedPrivateLinkResources: [
-      {
-        privateLinkResourceId: nestedDependencies.outputs.storageAccountResourceId
-        groupId: 'blob'
-        resourceRegion: nestedDependencies.outputs.storageAccountLocation
-        requestMessage: 'Please approve this request'
-      }
-      {
-        privateLinkResourceId: nestedDependencies.outputs.keyVaultResourceId
-        groupId: 'vault'
-        requestMessage: 'Please approve this request'
-      }
-    ]
-    tags: {
-      'hidden-title': 'This is visible in the resource name'
-      Environment: 'Non-Prod'
-      Role: 'DeploymentValidation'
     }
+    dependsOn: [
+      nestedDependencies
+    ]
   }
-  dependsOn: [
-    nestedDependencies
-  ]
-}
+]
diff --git a/avm/res/search/search-service/tests/e2e/waf-aligned/main.test.bicep b/avm/res/search/search-service/tests/e2e/waf-aligned/main.test.bicep
index 343f301ded..1d58f7f339 100644
--- a/avm/res/search/search-service/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/search/search-service/tests/e2e/waf-aligned/main.test.bicep
@@ -58,62 +58,65 @@ module diagnosticDependencies '../../../../../../utilities/e2e-template-assets/t
 // Test Execution //
 // ============== //
 
-module testDeployment '../../../main.bicep' = {
-  scope: resourceGroup
-  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
-  params: {
-    location: resourceLocation
-    name: '${namePrefix}${serviceShort}001'
-    sku: 'standard3'
-    cmkEnforcement: 'Enabled'
-    disableLocalAuth: false
-    authOptions: {
-      aadOrApiKey: {
-        aadAuthFailureMode: 'http401WithBearerChallenge'
-      }
-    }
-    hostingMode: 'highDensity'
-    partitionCount: 2
-    replicaCount: 3
-    managedIdentities: {
-      systemAssigned: true
-    }
-    lock: {
-      kind: 'CanNotDelete'
-      name: 'myCustomLockName'
-    }
-    networkRuleSet: {
-      ipRules: [
-        {
-          value: '40.74.28.0/23'
-        }
-        {
-          value: '87.147.204.13'
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      location: resourceLocation
+      name: '${namePrefix}${serviceShort}001'
+      sku: 'standard3'
+      cmkEnforcement: 'Enabled'
+      disableLocalAuth: false
+      authOptions: {
+        aadOrApiKey: {
+          aadAuthFailureMode: 'http401WithBearerChallenge'
         }
-      ]
-    }
-    diagnosticSettings: [
-      {
-        name: 'customSetting'
-        metricCategories: [
+      }
+      hostingMode: 'highDensity'
+      partitionCount: 2
+      replicaCount: 3
+      managedIdentities: {
+        systemAssigned: true
+      }
+      lock: {
+        kind: 'CanNotDelete'
+        name: 'myCustomLockName'
+      }
+      networkRuleSet: {
+        ipRules: [
           {
-            category: 'AllMetrics'
+            value: '40.74.28.0/23'
+          }
+          {
+            value: '87.147.204.13'
           }
         ]
-        eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
-        eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
-        storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
-        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
       }
-    ]
-    tags: {
-      'hidden-title': 'This is visible in the resource name'
-      Environment: 'Non-Prod'
-      Role: 'DeploymentValidation'
+      diagnosticSettings: [
+        {
+          name: 'customSetting'
+          metricCategories: [
+            {
+              category: 'AllMetrics'
+            }
+          ]
+          eventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName
+          eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
+          storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
+          workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+        }
+      ]
+      tags: {
+        'hidden-title': 'This is visible in the resource name'
+        Environment: 'Non-Prod'
+        Role: 'DeploymentValidation'
+      }
     }
+    dependsOn: [
+      nestedDependencies
+      diagnosticDependencies
+    ]
   }
-  dependsOn: [
-    nestedDependencies
-    diagnosticDependencies
-  ]
-}
+]
diff --git a/avm/res/search/search-service/version.json b/avm/res/search/search-service/version.json
index a8eda31021..e42c3d9e5f 100644
--- a/avm/res/search/search-service/version.json
+++ b/avm/res/search/search-service/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.5",
+    "version": "0.6",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/service-bus/namespace/README.md b/avm/res/service-bus/namespace/README.md
index ae0d879e07..6cee870109 100644
--- a/avm/res/service-bus/namespace/README.md
+++ b/avm/res/service-bus/namespace/README.md
@@ -295,9 +295,13 @@ module namespace 'br/public:avm/res/service-bus/namespace:<version>' = {
           }
         ]
         name: 'myPrivateEndpoint'
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         privateLinkServiceConnectionName: 'customLinkName'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -307,9 +311,13 @@ module namespace 'br/public:avm/res/service-bus/namespace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -561,9 +569,13 @@ module namespace 'br/public:avm/res/service-bus/namespace:<version>' = {
             }
           ],
           "name": "myPrivateEndpoint",
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "privateLinkServiceConnectionName": "customLinkName",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -573,9 +585,13 @@ module namespace 'br/public:avm/res/service-bus/namespace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -791,9 +807,13 @@ module namespace 'br/public:avm/res/service-bus/namespace:<version>' = {
     premiumMessagingPartitions: 1
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'namespace'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -966,9 +986,13 @@ module namespace 'br/public:avm/res/service-bus/namespace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "namespace",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -1712,8 +1736,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1897,19 +1920,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -3013,6 +3081,7 @@ Enabling this property creates a Premium Service Bus Namespace in regions suppor
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed service bus namespace. |
+| `privateEndpoints` | array | The private endpoints of the service bus namespace. |
 | `resourceGroupName` | string | The resource group of the deployed service bus namespace. |
 | `resourceId` | string | The resource ID of the deployed service bus namespace. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -3023,7 +3092,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/service-bus/namespace/main.bicep b/avm/res/service-bus/namespace/main.bicep
index 1c26424df2..507297992b 100644
--- a/avm/res/service-bus/namespace/main.bicep
+++ b/avm/res/service-bus/namespace/main.bicep
@@ -365,7 +365,7 @@ resource serviceBusNamespace_diagnosticSettings 'Microsoft.Insights/diagnosticSe
   }
 ]
 
-module serviceBusNamespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module serviceBusNamespace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-serviceBusNamespace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -406,8 +406,7 @@ module serviceBusNamespace_privateEndpoints 'br/public:avm/res/network/private-e
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -453,6 +452,17 @@ output systemAssignedMIPrincipalId string = serviceBusNamespace.?identity.?princ
 @description('The location the resource was deployed into.')
 output location string = serviceBusNamespace.location
 
+@description('The private endpoints of the service bus namespace.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: serviceBusNamespace_privateEndpoints[i].outputs.name
+    resourceId: serviceBusNamespace_privateEndpoints[i].outputs.resourceId
+    groupId: serviceBusNamespace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: serviceBusNamespace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: serviceBusNamespace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -515,11 +525,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/service-bus/namespace/main.json b/avm/res/service-bus/namespace/main.json
index 693c15dc2e..e3bdecdc0f 100644
--- a/avm/res/service-bus/namespace/main.json
+++ b/avm/res/service-bus/namespace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "227465215795701971"
+      "templateHash": "10964684048264975988"
     },
     "name": "Service Bus Namespaces",
     "description": "This module deploys a Service Bus Namespace.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -3463,11 +3486,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -3496,13 +3516,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -3754,6 +3795,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -3789,18 +3853,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -3881,7 +3938,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -3960,7 +4017,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -3971,28 +4028,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -4000,12 +4081,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -4019,27 +4103,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -4106,6 +4199,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -4156,6 +4256,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('serviceBusNamespace', '2022-10-01-preview', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the service bus namespace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('serviceBusNamespace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('serviceBusNamespace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('serviceBusNamespace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('serviceBusNamespace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('serviceBusNamespace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/service-bus/namespace/tests/e2e/max/main.test.bicep b/avm/res/service-bus/namespace/tests/e2e/max/main.test.bicep
index 1fc9965264..75f7aac495 100644
--- a/avm/res/service-bus/namespace/tests/e2e/max/main.test.bicep
+++ b/avm/res/service-bus/namespace/tests/e2e/max/main.test.bicep
@@ -256,9 +256,13 @@ module testDeployment '../../../main.bicep' = [
           name: 'myPrivateEndpoint'
           privateLinkServiceConnectionName: 'customLinkName'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -285,9 +289,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       managedIdentities: {
diff --git a/avm/res/service-bus/namespace/tests/e2e/waf-aligned/main.test.bicep b/avm/res/service-bus/namespace/tests/e2e/waf-aligned/main.test.bicep
index cbd896930d..f40c29ea50 100644
--- a/avm/res/service-bus/namespace/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/service-bus/namespace/tests/e2e/waf-aligned/main.test.bicep
@@ -180,9 +180,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'namespace'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
diff --git a/avm/res/service-bus/namespace/version.json b/avm/res/service-bus/namespace/version.json
index 21226dd43f..09c3664cec 100644
--- a/avm/res/service-bus/namespace/version.json
+++ b/avm/res/service-bus/namespace/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.6",
+  "version": "0.7",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/res/signal-r-service/signal-r/README.md b/avm/res/signal-r-service/signal-r/README.md
index 70f06dfab7..35f25de4aa 100644
--- a/avm/res/signal-r-service/signal-r/README.md
+++ b/avm/res/signal-r-service/signal-r/README.md
@@ -134,9 +134,13 @@ module signalR 'br/public:avm/res/signal-r-service/signal-r:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -145,9 +149,13 @@ module signalR 'br/public:avm/res/signal-r-service/signal-r:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -249,9 +257,13 @@ module signalR 'br/public:avm/res/signal-r-service/signal-r:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -260,9 +272,13 @@ module signalR 'br/public:avm/res/signal-r-service/signal-r:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -354,9 +370,13 @@ module signalR 'br/public:avm/res/signal-r-service/signal-r:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -438,9 +458,13 @@ module signalR 'br/public:avm/res/signal-r-service/signal-r:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -696,8 +720,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -881,19 +904,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1208,6 +1276,7 @@ Upstream templates to enable. For more information, see https://learn.microsoft.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The SignalR name. |
+| `privateEndpoints` | array | The private endpoints of the SignalR. |
 | `resourceGroupName` | string | The SignalR resource group. |
 | `resourceId` | string | The SignalR resource ID. |
 
@@ -1217,7 +1286,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/signal-r-service/signal-r/main.bicep b/avm/res/signal-r-service/signal-r/main.bicep
index 5e5c88ce39..37b7449350 100644
--- a/avm/res/signal-r-service/signal-r/main.bicep
+++ b/avm/res/signal-r-service/signal-r/main.bicep
@@ -240,7 +240,7 @@ resource signalR 'Microsoft.SignalRService/signalR@2022-02-01' = {
   }
 }
 
-module signalR_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module signalR_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-signalR-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -281,8 +281,7 @@ module signalR_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -332,6 +331,17 @@ output resourceId string = signalR.id
 @description('The location the resource was deployed into.')
 output location string = signalR.location
 
+@description('The private endpoints of the SignalR.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: signalR_privateEndpoints[i].outputs.name
+    resourceId: signalR_privateEndpoints[i].outputs.resourceId
+    groupId: signalR_privateEndpoints[i].outputs.groupId
+    customDnsConfig: signalR_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: signalR_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -386,11 +396,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/signal-r-service/signal-r/main.json b/avm/res/signal-r-service/signal-r/main.json
index 518c8c4894..6ed88a6fad 100644
--- a/avm/res/signal-r-service/signal-r/main.json
+++ b/avm/res/signal-r-service/signal-r/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "9623048216763413627"
+      "templateHash": "6232258125767604001"
     },
     "name": "SignalR Service SignalR",
     "description": "This module deploys a SignalR Service SignalR.",
@@ -150,21 +150,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -657,11 +680,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -690,13 +710,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -948,6 +989,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -983,18 +1047,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1075,7 +1132,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1154,7 +1211,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1165,28 +1222,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1194,12 +1275,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1213,27 +1297,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1300,6 +1393,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1343,6 +1443,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('signalR', '2022-02-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the SignalR."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('signalR_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('signalR_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('signalR_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('signalR_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('signalR_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/signal-r-service/signal-r/tests/e2e/max/main.test.bicep b/avm/res/signal-r-service/signal-r/tests/e2e/max/main.test.bicep
index ea1fe1f2b8..8ec75e7dac 100644
--- a/avm/res/signal-r-service/signal-r/tests/e2e/max/main.test.bicep
+++ b/avm/res/signal-r-service/signal-r/tests/e2e/max/main.test.bicep
@@ -84,9 +84,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -95,9 +99,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/signal-r-service/signal-r/tests/e2e/waf-aligned/main.test.bicep b/avm/res/signal-r-service/signal-r/tests/e2e/waf-aligned/main.test.bicep
index 51ca8dd306..009b496f45 100644
--- a/avm/res/signal-r-service/signal-r/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/signal-r-service/signal-r/tests/e2e/waf-aligned/main.test.bicep
@@ -79,9 +79,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
diff --git a/avm/res/signal-r-service/signal-r/version.json b/avm/res/signal-r-service/signal-r/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/signal-r-service/signal-r/version.json
+++ b/avm/res/signal-r-service/signal-r/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/signal-r-service/web-pub-sub/README.md b/avm/res/signal-r-service/web-pub-sub/README.md
index d2a2d00252..46fb8b2483 100644
--- a/avm/res/signal-r-service/web-pub-sub/README.md
+++ b/avm/res/signal-r-service/web-pub-sub/README.md
@@ -136,9 +136,13 @@ module webPubSub 'br/public:avm/res/signal-r-service/web-pub-sub:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'webpubsub'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -148,9 +152,13 @@ module webPubSub 'br/public:avm/res/signal-r-service/web-pub-sub:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -254,9 +262,13 @@ module webPubSub 'br/public:avm/res/signal-r-service/web-pub-sub:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "webpubsub",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -266,9 +278,13 @@ module webPubSub 'br/public:avm/res/signal-r-service/web-pub-sub:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -362,9 +378,13 @@ module webPubSub 'br/public:avm/res/signal-r-service/web-pub-sub:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'webpubsub'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -449,9 +469,13 @@ module webPubSub 'br/public:avm/res/signal-r-service/web-pub-sub:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "webpubsub",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -665,8 +689,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -850,19 +873,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1151,6 +1219,7 @@ Tags of the resource.
 | `hostName` | string | The Web PubSub hostName. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The Web PubSub name. |
+| `privateEndpoints` | array | The private endpoints of the Web PubSub. |
 | `publicPort` | int | The Web PubSub publicPort. |
 | `resourceGroupName` | string | The Web PubSub resource group. |
 | `resourceId` | string | The Web PubSub resource ID. |
@@ -1163,7 +1232,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/signal-r-service/web-pub-sub/main.bicep b/avm/res/signal-r-service/web-pub-sub/main.bicep
index c7cc0e8d77..a3821042f8 100644
--- a/avm/res/signal-r-service/web-pub-sub/main.bicep
+++ b/avm/res/signal-r-service/web-pub-sub/main.bicep
@@ -189,7 +189,7 @@ resource webPubSub 'Microsoft.SignalRService/webPubSub@2021-10-01' = {
   }
 }
 
-module webPubSub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module webPubSub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-webPubSub-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -230,8 +230,7 @@ module webPubSub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -296,6 +295,17 @@ output systemAssignedMIPrincipalId string = webPubSub.?identity.?principalId ??
 @description('The location the resource was deployed into.')
 output location string = webPubSub.location
 
+@description('The private endpoints of the Web PubSub.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: webPubSub_privateEndpoints[i].outputs.name
+    resourceId: webPubSub_privateEndpoints[i].outputs.resourceId
+    groupId: webPubSub_privateEndpoints[i].outputs.groupId
+    customDnsConfig: webPubSub_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: webPubSub_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -358,11 +368,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/signal-r-service/web-pub-sub/main.json b/avm/res/signal-r-service/web-pub-sub/main.json
index e4bbb1ad2d..5807cd4da1 100644
--- a/avm/res/signal-r-service/web-pub-sub/main.json
+++ b/avm/res/signal-r-service/web-pub-sub/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "7275087868796489976"
+      "templateHash": "3619836062547426326"
     },
     "name": "SignalR Web PubSub Services",
     "description": "This module deploys a SignalR Web PubSub Service.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -604,11 +627,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -637,13 +657,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -895,6 +936,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -930,18 +994,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1022,7 +1079,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1101,7 +1158,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1112,28 +1169,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1141,12 +1222,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1160,27 +1244,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1247,6 +1340,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1325,6 +1425,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('webPubSub', '2021-10-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Web PubSub."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('webPubSub_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('webPubSub_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('webPubSub_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('webPubSub_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('webPubSub_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/signal-r-service/web-pub-sub/tests/e2e/max/main.test.bicep b/avm/res/signal-r-service/web-pub-sub/tests/e2e/max/main.test.bicep
index dfbb4884b2..61f7b3dc9d 100644
--- a/avm/res/signal-r-service/web-pub-sub/tests/e2e/max/main.test.bicep
+++ b/avm/res/signal-r-service/web-pub-sub/tests/e2e/max/main.test.bicep
@@ -83,9 +83,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'webpubsub'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
@@ -95,9 +99,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/signal-r-service/web-pub-sub/tests/e2e/waf-aligned/main.test.bicep b/avm/res/signal-r-service/web-pub-sub/tests/e2e/waf-aligned/main.test.bicep
index a1ba316a76..34172c1749 100644
--- a/avm/res/signal-r-service/web-pub-sub/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/signal-r-service/web-pub-sub/tests/e2e/waf-aligned/main.test.bicep
@@ -78,9 +78,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'webpubsub'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/signal-r-service/web-pub-sub/version.json b/avm/res/signal-r-service/web-pub-sub/version.json
index c177b1bb58..3f863a2bec 100644
--- a/avm/res/signal-r-service/web-pub-sub/version.json
+++ b/avm/res/signal-r-service/web-pub-sub/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.3",
+    "version": "0.4",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/sql/server/README.md b/avm/res/sql/server/README.md
index 60cc8fcc38..e4306982f2 100644
--- a/avm/res/sql/server/README.md
+++ b/avm/res/sql/server/README.md
@@ -1,10 +1,5 @@
 # Azure SQL Servers `[Microsoft.Sql/servers]`
 
-> ⚠️THIS MODULE IS CURRENTLY ORPHANED.⚠️
-> 
-> - Only security and bug fixes are being handled by the AVM core team at present.
-> - If interested in becoming the module owner of this orphaned module (must be Microsoft FTE), please look for the related "orphaned module" GitHub issue [here](https://aka.ms/AVM/OrphanedModules)!
-
 This module deploys an Azure SQL Server.
 
 ## Navigation
@@ -335,9 +330,13 @@ module server 'br/public:avm/res/sql/server:<version>' = {
     primaryUserAssignedIdentityId: '<primaryUserAssignedIdentityId>'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -346,9 +345,13 @@ module server 'br/public:avm/res/sql/server:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -511,9 +514,13 @@ module server 'br/public:avm/res/sql/server:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -522,9 +529,13 @@ module server 'br/public:avm/res/sql/server:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -894,9 +905,13 @@ module server 'br/public:avm/res/sql/server:<version>' = {
     primaryUserAssignedIdentityId: '<primaryUserAssignedIdentityId>'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'sqlServer'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -1033,9 +1048,13 @@ module server 'br/public:avm/res/sql/server:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "sqlServer",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -1440,8 +1459,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1625,19 +1643,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1930,6 +1993,7 @@ The vulnerability assessment configuration.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed SQL server. |
+| `privateEndpoints` | array | The private endpoints of the SQL server. |
 | `resourceGroupName` | string | The resource group of the deployed SQL server. |
 | `resourceId` | string | The resource ID of the deployed SQL server. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1940,7 +2004,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/sql/server/database/README.md b/avm/res/sql/server/database/README.md
index 74071157f0..399bea6e82 100644
--- a/avm/res/sql/server/database/README.md
+++ b/avm/res/sql/server/database/README.md
@@ -482,7 +482,6 @@ Whether or not this database is zone redundant.
 
 - Required: No
 - Type: bool
-- Default: `False`
 
 ## Outputs
 
diff --git a/avm/res/sql/server/database/main.bicep b/avm/res/sql/server/database/main.bicep
index ff985b8eb6..f26259ab84 100644
--- a/avm/res/sql/server/database/main.bicep
+++ b/avm/res/sql/server/database/main.bicep
@@ -41,7 +41,7 @@ param maxSizeBytes int = 34359738368
 param sampleName string = ''
 
 @description('Optional. Whether or not this database is zone redundant.')
-param zoneRedundant bool = false
+param zoneRedundant bool = true
 
 @description('Optional. The license type to apply for this database.')
 param licenseType string = ''
diff --git a/avm/res/sql/server/database/main.json b/avm/res/sql/server/database/main.json
index 6a3ecbe9b8..a28b55efe8 100644
--- a/avm/res/sql/server/database/main.json
+++ b/avm/res/sql/server/database/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "8343448660522432164"
+      "templateHash": "6019999815954957727"
     },
     "name": "SQL Server Database",
     "description": "This module deploys an Azure SQL Server Database.",
@@ -217,7 +217,7 @@
     },
     "zoneRedundant": {
       "type": "bool",
-      "defaultValue": false,
+      "defaultValue": true,
       "metadata": {
         "description": "Optional. Whether or not this database is zone redundant."
       }
diff --git a/avm/res/sql/server/elastic-pool/README.md b/avm/res/sql/server/elastic-pool/README.md
index a0b3f7272d..d3cea3f1e2 100644
--- a/avm/res/sql/server/elastic-pool/README.md
+++ b/avm/res/sql/server/elastic-pool/README.md
@@ -166,7 +166,6 @@ Whether or not this elastic pool is zone redundant, which means the replicas of
 
 - Required: No
 - Type: bool
-- Default: `False`
 
 ## Outputs
 
diff --git a/avm/res/sql/server/elastic-pool/main.bicep b/avm/res/sql/server/elastic-pool/main.bicep
index 2e884fbc49..606aded8d8 100644
--- a/avm/res/sql/server/elastic-pool/main.bicep
+++ b/avm/res/sql/server/elastic-pool/main.bicep
@@ -49,7 +49,7 @@ param databaseMaxCapacity int = 2
 param databaseMinCapacity int = 0
 
 @description('Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones.')
-param zoneRedundant bool = false
+param zoneRedundant bool = true
 
 resource server 'Microsoft.Sql/servers@2023-08-01-preview' existing = {
   name: serverName
diff --git a/avm/res/sql/server/elastic-pool/main.json b/avm/res/sql/server/elastic-pool/main.json
index bc9ef67970..018727aa52 100644
--- a/avm/res/sql/server/elastic-pool/main.json
+++ b/avm/res/sql/server/elastic-pool/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "17663884310941548142"
+      "templateHash": "18037703368269722870"
     },
     "name": "SQL Server Elastic Pool",
     "description": "This module deploys an Azure SQL Server Elastic Pool.",
@@ -115,7 +115,7 @@
     },
     "zoneRedundant": {
       "type": "bool",
-      "defaultValue": false,
+      "defaultValue": true,
       "metadata": {
         "description": "Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones."
       }
diff --git a/avm/res/sql/server/main.bicep b/avm/res/sql/server/main.bicep
index 100d49f9d9..253c26b244 100644
--- a/avm/res/sql/server/main.bicep
+++ b/avm/res/sql/server/main.bicep
@@ -263,7 +263,7 @@ module server_databases 'database/main.bicep' = [
         : ''
       sampleName: contains(database, 'sampleName') ? database.sampleName : ''
       tags: database.?tags ?? tags
-      zoneRedundant: contains(database, 'zoneRedundant') ? database.zoneRedundant : false
+      zoneRedundant: contains(database, 'zoneRedundant') ? database.zoneRedundant : true
       elasticPoolId: contains(database, 'elasticPoolId') ? database.elasticPoolId : ''
       backupShortTermRetentionPolicy: contains(database, 'backupShortTermRetentionPolicy')
         ? database.backupShortTermRetentionPolicy
@@ -305,14 +305,14 @@ module server_elasticPools 'elastic-pool/main.bicep' = [
       skuCapacity: contains(elasticPool, 'skuCapacity') ? elasticPool.skuCapacity : 2
       skuName: contains(elasticPool, 'skuName') ? elasticPool.skuName : 'GP_Gen5'
       skuTier: contains(elasticPool, 'skuTier') ? elasticPool.skuTier : 'GeneralPurpose'
-      zoneRedundant: contains(elasticPool, 'zoneRedundant') ? elasticPool.zoneRedundant : false
+      zoneRedundant: contains(elasticPool, 'zoneRedundant') ? elasticPool.zoneRedundant : true
       location: location
       tags: elasticPool.?tags ?? tags
     }
   }
 ]
 
-module server_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module server_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-server-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -353,8 +353,7 @@ module server_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -507,6 +506,17 @@ output systemAssignedMIPrincipalId string = server.?identity.?principalId ?? ''
 @description('The location the resource was deployed into.')
 output location string = server.location
 
+@description('The private endpoints of the SQL server.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: server_privateEndpoints[i].outputs.name
+    resourceId: server_privateEndpoints[i].outputs.resourceId
+    groupId: server_privateEndpoints[i].outputs.groupId
+    customDnsConfig: server_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: server_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -569,11 +579,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/sql/server/main.json b/avm/res/sql/server/main.json
index 78cff13981..6f055afb2c 100644
--- a/avm/res/sql/server/main.json
+++ b/avm/res/sql/server/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "18130756437591455522"
+      "templateHash": "5025800136020814452"
     },
     "name": "Azure SQL Servers",
     "description": "This module deploys an Azure SQL Server.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -740,7 +763,7 @@
           "tags": {
             "value": "[coalesce(tryGet(parameters('databases')[copyIndex()], 'tags'), parameters('tags'))]"
           },
-          "zoneRedundant": "[if(contains(parameters('databases')[copyIndex()], 'zoneRedundant'), createObject('value', parameters('databases')[copyIndex()].zoneRedundant), createObject('value', false()))]",
+          "zoneRedundant": "[if(contains(parameters('databases')[copyIndex()], 'zoneRedundant'), createObject('value', parameters('databases')[copyIndex()].zoneRedundant), createObject('value', true()))]",
           "elasticPoolId": "[if(contains(parameters('databases')[copyIndex()], 'elasticPoolId'), createObject('value', parameters('databases')[copyIndex()].elasticPoolId), createObject('value', ''))]",
           "backupShortTermRetentionPolicy": "[if(contains(parameters('databases')[copyIndex()], 'backupShortTermRetentionPolicy'), createObject('value', parameters('databases')[copyIndex()].backupShortTermRetentionPolicy), createObject('value', createObject()))]",
           "backupLongTermRetentionPolicy": "[if(contains(parameters('databases')[copyIndex()], 'backupLongTermRetentionPolicy'), createObject('value', parameters('databases')[copyIndex()].backupLongTermRetentionPolicy), createObject('value', createObject()))]",
@@ -758,7 +781,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "8343448660522432164"
+              "templateHash": "6019999815954957727"
             },
             "name": "SQL Server Database",
             "description": "This module deploys an Azure SQL Server Database.",
@@ -969,7 +992,7 @@
             },
             "zoneRedundant": {
               "type": "bool",
-              "defaultValue": false,
+              "defaultValue": true,
               "metadata": {
                 "description": "Optional. Whether or not this database is zone redundant."
               }
@@ -1500,7 +1523,7 @@
           "skuCapacity": "[if(contains(parameters('elasticPools')[copyIndex()], 'skuCapacity'), createObject('value', parameters('elasticPools')[copyIndex()].skuCapacity), createObject('value', 2))]",
           "skuName": "[if(contains(parameters('elasticPools')[copyIndex()], 'skuName'), createObject('value', parameters('elasticPools')[copyIndex()].skuName), createObject('value', 'GP_Gen5'))]",
           "skuTier": "[if(contains(parameters('elasticPools')[copyIndex()], 'skuTier'), createObject('value', parameters('elasticPools')[copyIndex()].skuTier), createObject('value', 'GeneralPurpose'))]",
-          "zoneRedundant": "[if(contains(parameters('elasticPools')[copyIndex()], 'zoneRedundant'), createObject('value', parameters('elasticPools')[copyIndex()].zoneRedundant), createObject('value', false()))]",
+          "zoneRedundant": "[if(contains(parameters('elasticPools')[copyIndex()], 'zoneRedundant'), createObject('value', parameters('elasticPools')[copyIndex()].zoneRedundant), createObject('value', true()))]",
           "location": {
             "value": "[parameters('location')]"
           },
@@ -1516,7 +1539,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "17663884310941548142"
+              "templateHash": "18037703368269722870"
             },
             "name": "SQL Server Elastic Pool",
             "description": "This module deploys an Azure SQL Server Elastic Pool.",
@@ -1625,7 +1648,7 @@
             },
             "zoneRedundant": {
               "type": "bool",
-              "defaultValue": false,
+              "defaultValue": true,
               "metadata": {
                 "description": "Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones."
               }
@@ -1734,11 +1757,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1767,13 +1787,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -2025,6 +2066,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -2060,18 +2124,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -2152,7 +2209,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -2231,7 +2288,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -2242,28 +2299,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2271,12 +2352,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2290,27 +2374,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2377,6 +2470,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -3465,6 +3565,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('server', '2023-08-01-preview', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the SQL server."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/sql/server/tests/e2e/audit/main.test.bicep b/avm/res/sql/server/tests/e2e/audit/main.test.bicep
index dee526795e..0a205fb00c 100644
--- a/avm/res/sql/server/tests/e2e/audit/main.test.bicep
+++ b/avm/res/sql/server/tests/e2e/audit/main.test.bicep
@@ -9,14 +9,12 @@ metadata description = 'This instance deploys the module with auditing settings.
 
 @description('Optional. The name of the resource group to deploy for testing purposes.')
 @maxLength(90)
-// e.g., for a module 'network/private-endpoint' you could use 'dep-dev-network.privateendpoints-${serviceShort}-rg'
 param resourceGroupName string = 'dep-${namePrefix}-sql.servers-${serviceShort}-rg'
 
 @description('Optional. The location to deploy resources to.')
 param resourceLocation string = deployment().location
 
 @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
-// e.g., for a module 'network/private-endpoint' you could use 'npe' as a prefix and then 'waf' as a suffix for the waf-aligned test
 param serviceShort string = 'ssaud'
 
 @description('Optional. The password to leverage for the login.')
diff --git a/avm/res/sql/server/tests/e2e/defaults/main.test.bicep b/avm/res/sql/server/tests/e2e/defaults/main.test.bicep
index a6bb47978f..c9313eddaf 100644
--- a/avm/res/sql/server/tests/e2e/defaults/main.test.bicep
+++ b/avm/res/sql/server/tests/e2e/defaults/main.test.bicep
@@ -9,14 +9,12 @@ metadata description = 'This instance deploys the module with the minimum set of
 
 @description('Optional. The name of the resource group to deploy for testing purposes.')
 @maxLength(90)
-// e.g., for a module 'network/private-endpoint' you could use 'dep-dev-network.privateendpoints-${serviceShort}-rg'
 param resourceGroupName string = 'dep-${namePrefix}-sql.servers-${serviceShort}-rg'
 
 @description('Optional. The location to deploy resources to.')
 param resourceLocation string = deployment().location
 
 @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
-// e.g., for a module 'network/private-endpoint' you could use 'npe' as a prefix and then 'waf' as a suffix for the waf-aligned test
 param serviceShort string = 'ssmin'
 
 @description('Optional. The password to leverage for the login.')
diff --git a/avm/res/sql/server/tests/e2e/max/main.test.bicep b/avm/res/sql/server/tests/e2e/max/main.test.bicep
index 5487641c7f..662e8900fd 100644
--- a/avm/res/sql/server/tests/e2e/max/main.test.bicep
+++ b/avm/res/sql/server/tests/e2e/max/main.test.bicep
@@ -180,9 +180,13 @@ module testDeployment '../../../main.bicep' = {
     privateEndpoints: [
       {
         subnetResourceId: nestedDependencies.outputs.privateEndpointSubnetResourceId
-        privateDnsZoneResourceIds: [
-          nestedDependencies.outputs.privateDNSZoneResourceId
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+            }
+          ]
+        }
         tags: {
           'hidden-title': 'This is visible in the resource name'
           Environment: 'Non-Prod'
@@ -191,9 +195,13 @@ module testDeployment '../../../main.bicep' = {
       }
       {
         subnetResourceId: nestedDependencies.outputs.privateEndpointSubnetResourceId
-        privateDnsZoneResourceIds: [
-          nestedDependencies.outputs.privateDNSZoneResourceId
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+            }
+          ]
+        }
       }
     ]
     virtualNetworkRules: [
diff --git a/avm/res/sql/server/tests/e2e/waf-aligned/main.test.bicep b/avm/res/sql/server/tests/e2e/waf-aligned/main.test.bicep
index d0c16ff2b9..f444f7bf12 100644
--- a/avm/res/sql/server/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/sql/server/tests/e2e/waf-aligned/main.test.bicep
@@ -148,9 +148,13 @@ module testDeployment '../../../main.bicep' = {
       {
         subnetResourceId: nestedDependencies.outputs.privateEndpointSubnetResourceId
         service: 'sqlServer'
-        privateDnsZoneResourceIds: [
-          nestedDependencies.outputs.privateDNSZoneResourceId
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+            }
+          ]
+        }
         tags: {
           'hidden-title': 'This is visible in the resource name'
           Environment: 'Non-Prod'
diff --git a/avm/res/sql/server/version.json b/avm/res/sql/server/version.json
index a8eda31021..7e1d3f4157 100644
--- a/avm/res/sql/server/version.json
+++ b/avm/res/sql/server/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.5",
+    "version": "0.7",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/storage/storage-account/README.md b/avm/res/storage/storage-account/README.md
index c742d5df50..557a0ff537 100644
--- a/avm/res/storage/storage-account/README.md
+++ b/avm/res/storage/storage-account/README.md
@@ -19,6 +19,7 @@ This module deploys a Storage Account.
 | `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
 | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
+| `Microsoft.KeyVault/vaults/secrets` | [2023-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.KeyVault/2023-07-01/vaults/secrets) |
 | `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
 | `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 | `Microsoft.Storage/storageAccounts` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Storage/2022-09-01/storageAccounts) |
@@ -46,12 +47,13 @@ The following section provides usage examples for the module, which were used to
 - [Deploying as a Block Blob Storage](#example-2-deploying-as-a-block-blob-storage)
 - [Using only changefeed configuration](#example-3-using-only-changefeed-configuration)
 - [Using only defaults](#example-4-using-only-defaults)
-- [Using large parameter set](#example-5-using-large-parameter-set)
-- [Deploying with a NFS File Share](#example-6-deploying-with-a-nfs-file-share)
-- [Using Customer-Managed-Keys with System-Assigned identity](#example-7-using-customer-managed-keys-with-system-assigned-identity)
-- [Using Customer-Managed-Keys with User-Assigned identity](#example-8-using-customer-managed-keys-with-user-assigned-identity)
-- [Deploying as Storage Account version 1](#example-9-deploying-as-storage-account-version-1)
-- [WAF-aligned](#example-10-waf-aligned)
+- [Deploying with a key vault reference to save secrets](#example-5-deploying-with-a-key-vault-reference-to-save-secrets)
+- [Using large parameter set](#example-6-using-large-parameter-set)
+- [Deploying with a NFS File Share](#example-7-deploying-with-a-nfs-file-share)
+- [Using Customer-Managed-Keys with System-Assigned identity](#example-8-using-customer-managed-keys-with-system-assigned-identity)
+- [Using Customer-Managed-Keys with User-Assigned identity](#example-9-using-customer-managed-keys-with-user-assigned-identity)
+- [Deploying as Storage Account version 1](#example-10-deploying-as-storage-account-version-1)
+- [WAF-aligned](#example-11-waf-aligned)
 
 ### Example 1: _Deploying as a Blob Storage_
 
@@ -287,7 +289,71 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 </details>
 <p>
 
-### Example 5: _Using large parameter set_
+### Example 5: _Deploying with a key vault reference to save secrets_
+
+This instance deploys the module saving all its secrets in a key vault.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
+  name: 'storageAccountDeployment'
+  params: {
+    // Required parameters
+    name: 'kvref'
+    // Non-required parameters
+    location: '<location>'
+    secretsExportConfiguration: {
+      accessKey1: 'custom-key1-name'
+      accessKey2: 'custom-key2-name'
+      connectionString1: 'custom-connectionString1-name'
+      connectionString2: 'custom-connectionString2-name'
+      keyVaultResourceId: '<keyVaultResourceId>'
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "name": {
+      "value": "kvref"
+    },
+    // Non-required parameters
+    "location": {
+      "value": "<location>"
+    },
+    "secretsExportConfiguration": {
+      "value": {
+        "accessKey1": "custom-key1-name",
+        "accessKey2": "custom-key2-name",
+        "connectionString1": "custom-connectionString1-name",
+        "connectionString2": "custom-connectionString2-name",
+        "keyVaultResourceId": "<keyVaultResourceId>"
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 6: _Using large parameter set_
 
 This instance deploys the module with most of its features enabled.
 
@@ -511,9 +577,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -523,44 +593,68 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'table'
         subnetResourceId: '<subnetResourceId>'
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'queue'
         subnetResourceId: '<subnetResourceId>'
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'file'
         subnetResourceId: '<subnetResourceId>'
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'web'
         subnetResourceId: '<subnetResourceId>'
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'dfs'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -954,9 +1048,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -966,44 +1064,68 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>"
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "table",
           "subnetResourceId": "<subnetResourceId>"
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "queue",
           "subnetResourceId": "<subnetResourceId>"
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "file",
           "subnetResourceId": "<subnetResourceId>"
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "web",
           "subnetResourceId": "<subnetResourceId>"
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "dfs",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -1161,7 +1283,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 </details>
 <p>
 
-### Example 6: _Deploying with a NFS File Share_
+### Example 7: _Deploying with a NFS File Share_
 
 This instance deploys the module with a NFS File Share.
 
@@ -1235,7 +1357,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 </details>
 <p>
 
-### Example 7: _Using Customer-Managed-Keys with System-Assigned identity_
+### Example 8: _Using Customer-Managed-Keys with System-Assigned identity_
 
 This instance deploys the module using Customer-Managed-Keys using a System-Assigned Identity. This required the service to be deployed twice, once as a pre-requisite to create the System-Assigned Identity, and once to use it for accessing the Customer-Managed-Key secret.
 
@@ -1269,9 +1391,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -1324,9 +1450,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -1339,7 +1469,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 </details>
 <p>
 
-### Example 8: _Using Customer-Managed-Keys with User-Assigned identity_
+### Example 9: _Using Customer-Managed-Keys with User-Assigned identity_
 
 This instance deploys the module using Customer-Managed-Keys using a User-Assigned Identity to access the Customer-Managed-Key secret.
 
@@ -1380,9 +1510,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -1444,9 +1578,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -1459,7 +1597,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 </details>
 <p>
 
-### Example 9: _Deploying as Storage Account version 1_
+### Example 10: _Deploying as Storage Account version 1_
 
 This instance deploys the module as Storage Account version 1.
 
@@ -1511,7 +1649,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 </details>
 <p>
 
-### Example 10: _WAF-aligned_
+### Example 11: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
@@ -1689,9 +1827,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'blob'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -1972,9 +2114,13 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "blob",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -2117,6 +2263,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:<version>' = {
 | [`requireInfrastructureEncryption`](#parameter-requireinfrastructureencryption) | bool | A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true. |
 | [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
 | [`sasExpirationPeriod`](#parameter-sasexpirationperiod) | string | The SAS expiration period. DD.HH:MM:SS. |
+| [`secretsExportConfiguration`](#parameter-secretsexportconfiguration) | object | Key vault reference and secret settings for the module's secrets export. |
 | [`skuName`](#parameter-skuname) | string | Storage Account Sku Name. |
 | [`supportsHttpsTrafficOnly`](#parameter-supportshttpstrafficonly) | bool | Allows HTTPS traffic only to storage service if sets to true. |
 | [`tableServices`](#parameter-tableservices) | object | Table service and tables to create. |
@@ -2718,8 +2865,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2909,19 +3055,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -3178,6 +3369,63 @@ The SAS expiration period. DD.HH:MM:SS.
 - Type: string
 - Default: `''`
 
+### Parameter: `secretsExportConfiguration`
+
+Key vault reference and secret settings for the module's secrets export.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`keyVaultResourceId`](#parameter-secretsexportconfigurationkeyvaultresourceid) | string | The key vault name where to store the keys and connection strings generated by the modules. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`accessKey1`](#parameter-secretsexportconfigurationaccesskey1) | string | The accessKey1 secret name to create. |
+| [`accessKey2`](#parameter-secretsexportconfigurationaccesskey2) | string | The accessKey2 secret name to create. |
+| [`connectionString1`](#parameter-secretsexportconfigurationconnectionstring1) | string | The connectionString1 secret name to create. |
+| [`connectionString2`](#parameter-secretsexportconfigurationconnectionstring2) | string | The connectionString2 secret name to create. |
+
+### Parameter: `secretsExportConfiguration.keyVaultResourceId`
+
+The key vault name where to store the keys and connection strings generated by the modules.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `secretsExportConfiguration.accessKey1`
+
+The accessKey1 secret name to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `secretsExportConfiguration.accessKey2`
+
+The accessKey2 secret name to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `secretsExportConfiguration.connectionString1`
+
+The connectionString1 secret name to create.
+
+- Required: No
+- Type: string
+
+### Parameter: `secretsExportConfiguration.connectionString2`
+
+The connectionString2 secret name to create.
+
+- Required: No
+- Type: string
+
 ### Parameter: `skuName`
 
 Storage Account Sku Name.
@@ -3226,9 +3474,11 @@ Tags of the resource.
 
 | Output | Type | Description |
 | :-- | :-- | :-- |
+| `exportedSecrets` |  | A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed storage account. |
 | `primaryBlobEndpoint` | string | The primary blob endpoint reference if blob services are deployed. |
+| `privateEndpoints` | array | The private endpoints of the Storage Account. |
 | `resourceGroupName` | string | The resource group of the deployed storage account. |
 | `resourceId` | string | The resource ID of the deployed storage account. |
 | `serviceEndpoints` | object | All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint. |
@@ -3240,7 +3490,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/storage/storage-account/main.bicep b/avm/res/storage/storage-account/main.bicep
index 6e08223cba..9bcf736a9a 100644
--- a/avm/res/storage/storage-account/main.bicep
+++ b/avm/res/storage/storage-account/main.bicep
@@ -180,6 +180,9 @@ param sasExpirationPeriod string = ''
 ])
 param keyType string?
 
+@description('Optional. Key vault reference and secret settings for the module\'s secrets export.')
+param secretsExportConfiguration secretsExportConfigurationType?
+
 var supportsBlobService = kind == 'BlockBlobStorage' || kind == 'BlobStorage' || kind == 'StorageV2' || kind == 'Storage'
 var supportsFileService = kind == 'FileStorage' || kind == 'StorageV2' || kind == 'Storage'
 
@@ -238,6 +241,14 @@ var builtInRoleNames = {
     'Microsoft.Authorization/roleDefinitions',
     'db58b8e5-c6ad-4a2a-8342-4190687cbf4a'
   )
+  'Storage File Data Privileged Contributor': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    '69566ab7-960f-475b-8e7c-b3118f30c6bd'
+  )
+  'Storage File Data Privileged Reader': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    'b8eda974-7b85-4f76-af95-65846b26df6d'
+  )
   'Storage File Data SMB Share Contributor': subscriptionResourceId(
     'Microsoft.Authorization/roleDefinitions',
     '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb'
@@ -481,7 +492,7 @@ resource storageAccount_roleAssignments 'Microsoft.Authorization/roleAssignments
   }
 ]
 
-module storageAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module storageAccount_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-storageAccount-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -522,8 +533,7 @@ module storageAccount_privateEndpoints 'br/public:avm/res/network/private-endpoi
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -620,6 +630,52 @@ module storageAccount_tableServices 'table-service/main.bicep' = if (!empty(tabl
   }
 }
 
+module secretsExport 'modules/keyVaultExport.bicep' = if (secretsExportConfiguration != null) {
+  name: '${uniqueString(deployment().name, location)}-secrets-kv'
+  scope: resourceGroup(
+    split((secretsExportConfiguration.?keyVaultResourceId ?? '//'), '/')[2],
+    split((secretsExportConfiguration.?keyVaultResourceId ?? '////'), '/')[4]
+  )
+  params: {
+    keyVaultName: last(split(secretsExportConfiguration.?keyVaultResourceId ?? '//', '/'))
+    secretsToSet: union(
+      [],
+      contains(secretsExportConfiguration!, 'accessKey1')
+        ? [
+            {
+              name: secretsExportConfiguration!.accessKey1
+              value: storageAccount.listKeys().keys[0].value
+            }
+          ]
+        : [],
+      contains(secretsExportConfiguration!, 'connectionString1')
+        ? [
+            {
+              name: secretsExportConfiguration!.connectionString1
+              value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.listKeys().keys[0].value};EndpointSuffix=core.windows.net'
+            }
+          ]
+        : [],
+      contains(secretsExportConfiguration!, 'accessKey2')
+        ? [
+            {
+              name: secretsExportConfiguration!.accessKey2
+              value: storageAccount.listKeys().keys[1].value
+            }
+          ]
+        : [],
+      contains(secretsExportConfiguration!, 'connectionString2')
+        ? [
+            {
+              name: secretsExportConfiguration!.connectionString2
+              value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.listKeys().keys[1].value};EndpointSuffix=core.windows.net'
+            }
+          ]
+        : []
+    )
+  }
+}
+
 @description('The resource ID of the deployed storage account.')
 output resourceId string = storageAccount.id
 
@@ -643,6 +699,22 @@ output location string = storageAccount.location
 @description('All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint.')
 output serviceEndpoints object = storageAccount.properties.primaryEndpoints
 
+@description('The private endpoints of the Storage Account.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: storageAccount_privateEndpoints[i].outputs.name
+    resourceId: storageAccount_privateEndpoints[i].outputs.resourceId
+    groupId: storageAccount_privateEndpoints[i].outputs.groupId
+    customDnsConfig: storageAccount_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: storageAccount_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret\'s name.')
+output exportedSecrets secretsOutputType = (secretsExportConfiguration != null)
+  ? toObject(secretsExport.outputs.secretsSet, secret => last(split(secret.secretResourceId, '/')), secret => secret)
+  : {}
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -736,11 +808,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
+
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
@@ -843,3 +924,26 @@ type customerManagedKeyType = {
   @description('Optional. User assigned identity to use when fetching the customer managed key. If used must also be specified in `managedIdentities.userAssignedResourceIds`. Required if no system assigned identity is available for use.')
   userAssignedIdentityResourceId: string?
 }?
+
+type secretsExportConfigurationType = {
+  @description('Required. The key vault name where to store the keys and connection strings generated by the modules.')
+  keyVaultResourceId: string
+
+  @description('Optional. The accessKey1 secret name to create.')
+  accessKey1: string?
+
+  @description('Optional. The connectionString1 secret name to create.')
+  connectionString1: string?
+
+  @description('Optional. The accessKey2 secret name to create.')
+  accessKey2: string?
+
+  @description('Optional. The connectionString2 secret name to create.')
+  connectionString2: string?
+}
+
+import { secretSetType } from 'modules/keyVaultExport.bicep'
+type secretsOutputType = {
+  @description('An exported secret\'s references.')
+  *: secretSetType
+}
diff --git a/avm/res/storage/storage-account/main.json b/avm/res/storage/storage-account/main.json
index 0bbd242ac7..d73a89ee8f 100644
--- a/avm/res/storage/storage-account/main.json
+++ b/avm/res/storage/storage-account/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "7446053749806505838"
+      "templateHash": "13539810648097972278"
     },
     "name": "Storage Accounts",
     "description": "This module deploys a Storage Account.",
@@ -243,21 +243,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -519,6 +542,77 @@
         }
       },
       "nullable": true
+    },
+    "secretsExportConfigurationType": {
+      "type": "object",
+      "properties": {
+        "keyVaultResourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+          }
+        },
+        "accessKey1": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The accessKey1 secret name to create."
+          }
+        },
+        "connectionString1": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The connectionString1 secret name to create."
+          }
+        },
+        "accessKey2": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The accessKey2 secret name to create."
+          }
+        },
+        "connectionString2": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. The connectionString2 secret name to create."
+          }
+        }
+      }
+    },
+    "secretsOutputType": {
+      "type": "object",
+      "properties": {},
+      "additionalProperties": {
+        "$ref": "#/definitions/secretSetType",
+        "metadata": {
+          "description": "An exported secret's references."
+        }
+      }
+    },
+    "secretSetType": {
+      "type": "object",
+      "properties": {
+        "secretResourceId": {
+          "type": "string",
+          "metadata": {
+            "description": "The resourceId of the exported secret."
+          }
+        },
+        "secretUri": {
+          "type": "string",
+          "metadata": {
+            "description": "The secret URI of the exported secret."
+          }
+        }
+      },
+      "metadata": {
+        "__bicep_imported_from!": {
+          "sourceTemplate": "modules/keyVaultExport.bicep"
+        }
+      }
     }
   },
   "parameters": {
@@ -845,6 +939,13 @@
       "metadata": {
         "description": "Optional. The keyType to use with Queue & Table services."
       }
+    },
+    "secretsExportConfiguration": {
+      "$ref": "#/definitions/secretsExportConfigurationType",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+      }
     }
   },
   "variables": {
@@ -872,6 +973,8 @@
       "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
       "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
       "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+      "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
+      "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
       "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
       "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
       "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
@@ -1076,11 +1179,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1109,13 +1209,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1367,6 +1488,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1402,18 +1546,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1494,7 +1631,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1573,7 +1710,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1584,28 +1721,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1613,12 +1774,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1632,27 +1796,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1719,6 +1892,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -4697,6 +4877,140 @@
       "dependsOn": [
         "storageAccount"
       ]
+    },
+    "secretsExport": {
+      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+      "subscriptionId": "[split(coalesce(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '//'), '/')[2]]",
+      "resourceGroup": "[split(coalesce(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '////'), '/')[4]]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "keyVaultName": {
+            "value": "[last(split(coalesce(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '//'), '/'))]"
+          },
+          "secretsToSet": {
+            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1'), createArray(createObject('name', parameters('secretsExportConfiguration').accessKey1, 'value', listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2022-09-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1'), createArray(createObject('name', parameters('secretsExportConfiguration').connectionString1, 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix=core.windows.net', parameters('name'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2022-09-01').keys[0].value))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2'), createArray(createObject('name', parameters('secretsExportConfiguration').accessKey2, 'value', listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2022-09-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2'), createArray(createObject('name', parameters('secretsExportConfiguration').connectionString2, 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix=core.windows.net', parameters('name'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2022-09-01').keys[1].value))), createArray()))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "986606208324987345"
+            }
+          },
+          "definitions": {
+            "secretSetType": {
+              "type": "object",
+              "properties": {
+                "secretResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resourceId of the exported secret."
+                  }
+                },
+                "secretUri": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The secret URI of the exported secret."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true
+              }
+            },
+            "secretToSetType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the secret to set."
+                  }
+                },
+                "value": {
+                  "type": "securestring",
+                  "metadata": {
+                    "description": "Required. The value of the secret to set."
+                  }
+                }
+              }
+            }
+          },
+          "parameters": {
+            "keyVaultName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the Key Vault to set the ecrets in."
+              }
+            },
+            "secretsToSet": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/secretToSetType"
+              },
+              "metadata": {
+                "description": "Required. The secrets to set in the Key Vault."
+              }
+            }
+          },
+          "resources": {
+            "keyVault": {
+              "existing": true,
+              "type": "Microsoft.KeyVault/vaults",
+              "apiVersion": "2022-07-01",
+              "name": "[parameters('keyVaultName')]"
+            },
+            "secrets": {
+              "copy": {
+                "name": "secrets",
+                "count": "[length(parameters('secretsToSet'))]"
+              },
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+              "properties": {
+                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+              },
+              "dependsOn": [
+                "keyVault"
+              ]
+            }
+          },
+          "outputs": {
+            "secretsSet": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/secretSetType"
+              },
+              "metadata": {
+                "description": "The references to the secrets exported to the provided Key Vault."
+              },
+              "copy": {
+                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                "input": {
+                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
+                }
+              }
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "storageAccount"
+      ]
     }
   },
   "outputs": {
@@ -4748,6 +5062,29 @@
         "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
       },
       "value": "[reference('storageAccount').primaryEndpoints]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Storage Account."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "exportedSecrets": {
+      "$ref": "#/definitions/secretsOutputType",
+      "metadata": {
+        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+      },
+      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/storage/storage-account/modules/keyVaultExport.bicep b/avm/res/storage/storage-account/modules/keyVaultExport.bicep
new file mode 100644
index 0000000000..d537d2407e
--- /dev/null
+++ b/avm/res/storage/storage-account/modules/keyVaultExport.bicep
@@ -0,0 +1,62 @@
+// ============== //
+//   Parameters   //
+// ============== //
+
+@description('Required. The name of the Key Vault to set the ecrets in.')
+param keyVaultName string
+
+@description('Required. The secrets to set in the Key Vault.')
+param secretsToSet secretToSetType[]
+
+// ============= //
+//   Resources   //
+// ============= //
+
+resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
+  name: keyVaultName
+}
+
+resource secrets 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = [
+  for secret in secretsToSet: {
+    name: secret.name
+    parent: keyVault
+    properties: {
+      value: secret.value
+    }
+  }
+]
+
+// =========== //
+//   Outputs   //
+// =========== //
+
+@description('The references to the secrets exported to the provided Key Vault.')
+output secretsSet secretSetType[] = [
+  #disable-next-line outputs-should-not-contain-secrets // Only returning the references, not a secret value
+  for index in range(0, length(secretsToSet ?? [])): {
+    secretResourceId: secrets[index].id
+    secretUri: secrets[index].properties.secretUri
+  }
+]
+
+// =============== //
+//   Definitions   //
+// =============== //
+
+@export()
+type secretSetType = {
+  @description('The resourceId of the exported secret.')
+  secretResourceId: string
+
+  @description('The secret URI of the exported secret.')
+  secretUri: string
+}
+
+type secretToSetType = {
+  @description('Required. The name of the secret to set.')
+  name: string
+
+  @description('Required. The value of the secret to set.')
+  @secure()
+  value: string
+}
diff --git a/avm/res/storage/storage-account/tests/e2e/kvSecrets/dependencies.bicep b/avm/res/storage/storage-account/tests/e2e/kvSecrets/dependencies.bicep
new file mode 100644
index 0000000000..61c051d86d
--- /dev/null
+++ b/avm/res/storage/storage-account/tests/e2e/kvSecrets/dependencies.bicep
@@ -0,0 +1,21 @@
+@description('Optional. The location to deploy to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Managed Identity to create.')
+param keyVaultName string
+
+resource keyVault 'Microsoft.KeyVault/vaults@2021-06-01-preview' = {
+  name: keyVaultName
+  location: location
+  properties: {
+    sku: {
+      family: 'A'
+      name: 'standard'
+    }
+    enableRbacAuthorization: true
+    tenantId: subscription().tenantId
+  }
+}
+
+@description('The name of the Key Vault created.')
+output keyVaultResourceId string = keyVault.id
diff --git a/avm/res/storage/storage-account/tests/e2e/kvSecrets/main.test.bicep b/avm/res/storage/storage-account/tests/e2e/kvSecrets/main.test.bicep
new file mode 100644
index 0000000000..6efab286b0
--- /dev/null
+++ b/avm/res/storage/storage-account/tests/e2e/kvSecrets/main.test.bicep
@@ -0,0 +1,58 @@
+targetScope = 'subscription'
+
+metadata name = 'Deploying with a key vault reference to save secrets'
+metadata description = 'This instance deploys the module saving all its secrets in a key vault.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-storage.storageaccount-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'ssakvs'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============== //
+// General resources
+// ============== //
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2022-09-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}'
+    location: resourceLocation
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+module testDeployment '../../../main.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}'
+  params: {
+    location: resourceLocation
+    name: '${namePrefix}kvref'
+    secretsExportConfiguration: {
+      keyVaultResourceId: nestedDependencies.outputs.keyVaultResourceId
+      accessKey1: 'custom-key1-name'
+      accessKey2: 'custom-key2-name'
+      connectionString1: 'custom-connectionString1-name'
+      connectionString2: 'custom-connectionString2-name'
+    }
+  }
+}
diff --git a/avm/res/storage/storage-account/tests/e2e/max/main.test.bicep b/avm/res/storage/storage-account/tests/e2e/max/main.test.bicep
index b0751eec2b..87651382b4 100644
--- a/avm/res/storage/storage-account/tests/e2e/max/main.test.bicep
+++ b/avm/res/storage/storage-account/tests/e2e/max/main.test.bicep
@@ -82,9 +82,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -94,42 +98,66 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.customSubnet2ResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           service: 'table'
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           service: 'queue'
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           service: 'file'
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           service: 'web'
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           service: 'dfs'
         }
diff --git a/avm/res/storage/storage-account/tests/e2e/system-assigned-cmk-encryption/main.test.bicep b/avm/res/storage/storage-account/tests/e2e/system-assigned-cmk-encryption/main.test.bicep
index 61601f8448..f25d1ddd78 100644
--- a/avm/res/storage/storage-account/tests/e2e/system-assigned-cmk-encryption/main.test.bicep
+++ b/avm/res/storage/storage-account/tests/e2e/system-assigned-cmk-encryption/main.test.bicep
@@ -62,9 +62,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       blobServices: {
diff --git a/avm/res/storage/storage-account/tests/e2e/user-assigned-cmk-encryption/main.test.bicep b/avm/res/storage/storage-account/tests/e2e/user-assigned-cmk-encryption/main.test.bicep
index 7049c42687..47a49ecd3d 100644
--- a/avm/res/storage/storage-account/tests/e2e/user-assigned-cmk-encryption/main.test.bicep
+++ b/avm/res/storage/storage-account/tests/e2e/user-assigned-cmk-encryption/main.test.bicep
@@ -66,9 +66,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       blobServices: {
diff --git a/avm/res/storage/storage-account/tests/e2e/waf-aligned/main.test.bicep b/avm/res/storage/storage-account/tests/e2e/waf-aligned/main.test.bicep
index e610d70df3..2764fa29fc 100644
--- a/avm/res/storage/storage-account/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/storage/storage-account/tests/e2e/waf-aligned/main.test.bicep
@@ -78,9 +78,13 @@ module testDeployment '../../../main.bicep' = [
         {
           service: 'blob'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
diff --git a/avm/res/storage/storage-account/version.json b/avm/res/storage/storage-account/version.json
index 6a120cace8..23f3815885 100644
--- a/avm/res/storage/storage-account/version.json
+++ b/avm/res/storage/storage-account/version.json
@@ -1,7 +1,7 @@
 {
-    "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.11",
-    "pathFilters": [
-        "./main.json"
-    ]
+  "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
+  "version": "0.12",
+  "pathFilters": [
+    "./main.json"
+  ]
 }
\ No newline at end of file
diff --git a/avm/res/synapse/private-link-hub/README.md b/avm/res/synapse/private-link-hub/README.md
index 3c8af06295..6b406c9bd6 100644
--- a/avm/res/synapse/private-link-hub/README.md
+++ b/avm/res/synapse/private-link-hub/README.md
@@ -109,9 +109,13 @@ module privateLinkHub 'br/public:avm/res/synapse/private-link-hub:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -120,9 +124,13 @@ module privateLinkHub 'br/public:avm/res/synapse/private-link-hub:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -178,9 +186,13 @@ module privateLinkHub 'br/public:avm/res/synapse/private-link-hub:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -189,9 +201,13 @@ module privateLinkHub 'br/public:avm/res/synapse/private-link-hub:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -245,9 +261,13 @@ module privateLinkHub 'br/public:avm/res/synapse/private-link-hub:<version>' = {
     location: '<location>'
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'Web'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -289,9 +309,13 @@ module privateLinkHub 'br/public:avm/res/synapse/private-link-hub:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "Web",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -421,8 +445,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -606,19 +629,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -855,6 +923,7 @@ Tags of the resource.
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed Synapse Private Link Hub. |
+| `privateEndpoints` | array | The private endpoints of the Synapse Private Link Hub. |
 | `resourceGroupName` | string | The resource group of the deployed Synapse Private Link Hub. |
 | `resourceId` | string | The resource ID of the deployed Synapse Private Link Hub. |
 
@@ -864,7 +933,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/synapse/private-link-hub/main.bicep b/avm/res/synapse/private-link-hub/main.bicep
index 863538dd6e..12ed80fc97 100644
--- a/avm/res/synapse/private-link-hub/main.bicep
+++ b/avm/res/synapse/private-link-hub/main.bicep
@@ -103,7 +103,7 @@ resource privateLinkHub_roleAssignments 'Microsoft.Authorization/roleAssignments
 ]
 
 // Private Endpoints
-module privateLinkHub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module privateLinkHub_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-privateLinkHub-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -144,8 +144,7 @@ module privateLinkHub_privateEndpoints 'br/public:avm/res/network/private-endpoi
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -168,6 +167,17 @@ output resourceGroupName string = resourceGroup().name
 @description('The location the resource was deployed into.')
 output location string = privateLinkHub.location
 
+@description('The private endpoints of the Synapse Private Link Hub.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: privateLinkHub_privateEndpoints[i].outputs.name
+    resourceId: privateLinkHub_privateEndpoints[i].outputs.resourceId
+    groupId: privateLinkHub_privateEndpoints[i].outputs.groupId
+    customDnsConfig: privateLinkHub_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: privateLinkHub_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -222,11 +232,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/synapse/private-link-hub/main.json b/avm/res/synapse/private-link-hub/main.json
index 0990e1175b..b19850cd41 100644
--- a/avm/res/synapse/private-link-hub/main.json
+++ b/avm/res/synapse/private-link-hub/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "14426311365279116050"
+      "templateHash": "543021970961540498"
     },
     "name": "Azure Synapse Analytics",
     "description": "This module deploys an Azure Synapse Analytics (Private Link Hub).",
@@ -150,21 +150,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -468,11 +491,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -501,13 +521,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -759,6 +800,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -794,18 +858,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -886,7 +943,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -965,7 +1022,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -976,28 +1033,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1005,12 +1086,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1024,27 +1108,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1111,6 +1204,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1154,6 +1254,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('privateLinkHub', '2021-06-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Synapse Private Link Hub."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('privateLinkHub_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('privateLinkHub_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('privateLinkHub_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('privateLinkHub_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('privateLinkHub_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/synapse/private-link-hub/tests/e2e/max/main.test.bicep b/avm/res/synapse/private-link-hub/tests/e2e/max/main.test.bicep
index 2b390c768e..9a23fdc068 100644
--- a/avm/res/synapse/private-link-hub/tests/e2e/max/main.test.bicep
+++ b/avm/res/synapse/private-link-hub/tests/e2e/max/main.test.bicep
@@ -60,9 +60,13 @@ module testDeployment '../../../main.bicep' = [
       }
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
             'hidden-title': 'This is visible in the resource name'
@@ -71,9 +75,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
         }
       ]
diff --git a/avm/res/synapse/private-link-hub/tests/e2e/waf-aligned/main.test.bicep b/avm/res/synapse/private-link-hub/tests/e2e/waf-aligned/main.test.bicep
index bbbdccf99e..b12fd87d4f 100644
--- a/avm/res/synapse/private-link-hub/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/synapse/private-link-hub/tests/e2e/waf-aligned/main.test.bicep
@@ -55,9 +55,13 @@ module testDeployment '../../../main.bicep' = [
       location: resourceLocation
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'Web'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/synapse/private-link-hub/version.json b/avm/res/synapse/private-link-hub/version.json
index 3f863a2bec..a8eda31021 100644
--- a/avm/res/synapse/private-link-hub/version.json
+++ b/avm/res/synapse/private-link-hub/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.4",
+    "version": "0.5",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/synapse/workspace/README.md b/avm/res/synapse/workspace/README.md
index 026520bae4..d9b6a461a3 100644
--- a/avm/res/synapse/workspace/README.md
+++ b/avm/res/synapse/workspace/README.md
@@ -28,6 +28,7 @@ This module deploys a Synapse Workspace.
 | `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 | `Microsoft.Synapse/workspaces` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Synapse/2021-06-01/workspaces) |
 | `Microsoft.Synapse/workspaces/administrators` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Synapse/2021-06-01/workspaces/administrators) |
+| `Microsoft.Synapse/workspaces/firewallRules` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Synapse/2021-06-01/workspaces/firewallRules) |
 | `Microsoft.Synapse/workspaces/integrationRuntimes` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Synapse/2021-06-01/workspaces/integrationRuntimes) |
 | `Microsoft.Synapse/workspaces/keys` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Synapse/2021-06-01/workspaces/keys) |
 
@@ -42,9 +43,10 @@ The following section provides usage examples for the module, which were used to
 - [Using only defaults](#example-1-using-only-defaults)
 - [Using encryption with Customer-Managed-Key](#example-2-using-encryption-with-customer-managed-key)
 - [Using encryption with Customer-Managed-Key](#example-3-using-encryption-with-customer-managed-key)
-- [Using managed Vnet](#example-4-using-managed-vnet)
-- [Using large parameter set](#example-5-using-large-parameter-set)
-- [WAF-aligned](#example-6-waf-aligned)
+- [Using firewall rules](#example-4-using-firewall-rules)
+- [Using managed Vnet](#example-5-using-managed-vnet)
+- [Using large parameter set](#example-6-using-large-parameter-set)
+- [WAF-aligned](#example-7-waf-aligned)
 
 ### Example 1: _Using only defaults_
 
@@ -252,7 +254,93 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
 </details>
 <p>
 
-### Example 4: _Using managed Vnet_
+### Example 4: _Using firewall rules_
+
+This instance deploys the module with the configuration of firewall rules.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
+  name: 'workspaceDeployment'
+  params: {
+    // Required parameters
+    defaultDataLakeStorageAccountResourceId: '<defaultDataLakeStorageAccountResourceId>'
+    defaultDataLakeStorageFilesystem: '<defaultDataLakeStorageFilesystem>'
+    name: 'swfwr001'
+    sqlAdministratorLogin: 'synwsadmin'
+    // Non-required parameters
+    firewallRules: [
+      {
+        endIpAddress: '87.14.134.20'
+        name: 'fwrule01'
+        startIpAddress: '87.14.134.20'
+      }
+      {
+        endIpAddress: '87.14.134.22'
+        name: 'fwrule02'
+        startIpAddress: '87.14.134.21'
+      }
+    ]
+    location: '<location>'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    // Required parameters
+    "defaultDataLakeStorageAccountResourceId": {
+      "value": "<defaultDataLakeStorageAccountResourceId>"
+    },
+    "defaultDataLakeStorageFilesystem": {
+      "value": "<defaultDataLakeStorageFilesystem>"
+    },
+    "name": {
+      "value": "swfwr001"
+    },
+    "sqlAdministratorLogin": {
+      "value": "synwsadmin"
+    },
+    // Non-required parameters
+    "firewallRules": {
+      "value": [
+        {
+          "endIpAddress": "87.14.134.20",
+          "name": "fwrule01",
+          "startIpAddress": "87.14.134.20"
+        },
+        {
+          "endIpAddress": "87.14.134.22",
+          "name": "fwrule02",
+          "startIpAddress": "87.14.134.21"
+        }
+      ]
+    },
+    "location": {
+      "value": "<location>"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 5: _Using managed Vnet_
 
 This instance deploys the module using a managed Vnet.
 
@@ -328,7 +416,7 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
 </details>
 <p>
 
-### Example 5: _Using large parameter set_
+### Example 6: _Using large parameter set_
 
 This instance deploys the module with most of its features enabled.
 
@@ -385,9 +473,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
     managedVirtualNetwork: true
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'SQL'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -397,9 +489,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'SQL'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -409,9 +505,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'SqlOnDemand'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -421,9 +521,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'Dev'
         subnetResourceId: '<subnetResourceId>'
       }
@@ -530,9 +634,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "SQL",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -542,9 +650,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "SQL",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -554,9 +666,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "SqlOnDemand",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -566,9 +682,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "Dev",
           "subnetResourceId": "<subnetResourceId>"
         }
@@ -602,7 +722,7 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
 </details>
 <p>
 
-### Example 6: _WAF-aligned_
+### Example 7: _WAF-aligned_
 
 This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
 
@@ -648,9 +768,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
     managedVirtualNetwork: true
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         service: 'SQL'
         subnetResourceId: '<subnetResourceId>'
         tags: {
@@ -731,9 +855,13 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "service": "SQL",
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
@@ -782,6 +910,7 @@ module workspace 'br/public:avm/res/synapse/workspace:<version>' = {
 | [`diagnosticSettings`](#parameter-diagnosticsettings) | array | The diagnostic settings of the service. |
 | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
 | [`encryptionActivateWorkspace`](#parameter-encryptionactivateworkspace) | bool | Activate workspace by adding the system managed identity in the KeyVault containing the customer managed key and activating the workspace. |
+| [`firewallRules`](#parameter-firewallrules) | array | List of firewall rules to be created in the workspace. |
 | [`initialWorkspaceAdminObjectID`](#parameter-initialworkspaceadminobjectid) | string | AAD object ID of initial workspace admin. |
 | [`integrationRuntimes`](#parameter-integrationruntimes) | array | The Integration Runtimes to create. |
 | [`linkedAccessCheckOnTargetResource`](#parameter-linkedaccesscheckontargetresource) | bool | Linked Access Check On Target Resource. |
@@ -1077,6 +1206,42 @@ Activate workspace by adding the system managed identity in the KeyVault contain
 - Type: bool
 - Default: `False`
 
+### Parameter: `firewallRules`
+
+List of firewall rules to be created in the workspace.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`endIpAddress`](#parameter-firewallrulesendipaddress) | string | The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. |
+| [`name`](#parameter-firewallrulesname) | string | The name of the firewall rule. |
+| [`startIpAddress`](#parameter-firewallrulesstartipaddress) | string | The start IP address of the firewall rule. Must be IPv4 format. |
+
+### Parameter: `firewallRules.endIpAddress`
+
+The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `firewallRules.name`
+
+The name of the firewall rule.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `firewallRules.startIpAddress`
+
+The start IP address of the firewall rule. Must be IPv4 format.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `initialWorkspaceAdminObjectID`
 
 AAD object ID of initial workspace admin.
@@ -1217,8 +1382,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -1408,19 +1572,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1689,6 +1898,7 @@ Git integration settings.
 | `connectivityEndpoints` | object | The workspace connectivity endpoints. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the deployed Synapse Workspace. |
+| `privateEndpoints` | array | The private endpoints of the Synapse Workspace. |
 | `resourceGroupName` | string | The resource group of the deployed Synapse Workspace. |
 | `resourceID` | string | The resource ID of the deployed Synapse Workspace. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1699,7 +1909,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/synapse/workspace/firewall-rules/README.md b/avm/res/synapse/workspace/firewall-rules/README.md
new file mode 100644
index 0000000000..dc5cdad28d
--- /dev/null
+++ b/avm/res/synapse/workspace/firewall-rules/README.md
@@ -0,0 +1,67 @@
+# Synapse Workspaces Firewall Rules `[Microsoft.Synapse/workspaces/firewallRules]`
+
+This module deploys Synapse Workspaces Firewall Rules.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Synapse/workspaces/firewallRules` | [2021-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Synapse/2021-06-01/workspaces/firewallRules) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`endIpAddress`](#parameter-endipaddress) | string | The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. |
+| [`name`](#parameter-name) | string | The name of the firewall rule. |
+| [`startIpAddress`](#parameter-startipaddress) | string | The start IP address of the firewall rule. Must be IPv4 format. |
+
+**Conditional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`workspaceName`](#parameter-workspacename) | string | The name of the parent Synapse Workspace. Required if the template is used in a standalone deployment. |
+
+### Parameter: `endIpAddress`
+
+The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `name`
+
+The name of the firewall rule.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `startIpAddress`
+
+The start IP address of the firewall rule. Must be IPv4 format.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `workspaceName`
+
+The name of the parent Synapse Workspace. Required if the template is used in a standalone deployment.
+
+- Required: Yes
+- Type: string
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the deployed firewall rule. |
+| `resourceGroupName` | string | The resource group of the deployed firewall rule. |
+| `resourceId` | string | The resource ID of the deployed firewall rule. |
diff --git a/avm/res/synapse/workspace/firewall-rules/main.bicep b/avm/res/synapse/workspace/firewall-rules/main.bicep
new file mode 100644
index 0000000000..a3e12b4eca
--- /dev/null
+++ b/avm/res/synapse/workspace/firewall-rules/main.bicep
@@ -0,0 +1,37 @@
+metadata name = 'Synapse Workspaces Firewall Rules'
+metadata description = 'This module deploys Synapse Workspaces Firewall Rules.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Conditional. The name of the parent Synapse Workspace. Required if the template is used in a standalone deployment.')
+param workspaceName string
+
+@description('Required. The name of the firewall rule.')
+param name string
+
+@description('Required. The start IP address of the firewall rule. Must be IPv4 format.')
+param startIpAddress string
+
+@description('Required. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress.')
+param endIpAddress string
+
+resource workspace 'Microsoft.Synapse/workspaces@2021-06-01' existing = {
+  name: workspaceName
+}
+
+resource firewallRule 'Microsoft.Synapse/workspaces/firewallRules@2021-06-01' = {
+  name: name
+  parent: workspace
+  properties: {
+    startIpAddress: startIpAddress
+    endIpAddress: endIpAddress
+  }
+}
+
+@description('The name of the deployed firewall rule.')
+output name string = firewallRule.name
+
+@description('The resource ID of the deployed firewall rule.')
+output resourceId string = firewallRule.id
+
+@description('The resource group of the deployed firewall rule.')
+output resourceGroupName string = resourceGroup().name
diff --git a/avm/res/synapse/workspace/firewall-rules/main.json b/avm/res/synapse/workspace/firewall-rules/main.json
new file mode 100644
index 0000000000..ce7fd0baaa
--- /dev/null
+++ b/avm/res/synapse/workspace/firewall-rules/main.json
@@ -0,0 +1,74 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.29.47.4906",
+      "templateHash": "6729418057172891787"
+    },
+    "name": "Synapse Workspaces Firewall Rules",
+    "description": "This module deploys Synapse Workspaces Firewall Rules.",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "workspaceName": {
+      "type": "string",
+      "metadata": {
+        "description": "Conditional. The name of the parent Synapse Workspace. Required if the template is used in a standalone deployment."
+      }
+    },
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The name of the firewall rule."
+      }
+    },
+    "startIpAddress": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The start IP address of the firewall rule. Must be IPv4 format."
+      }
+    },
+    "endIpAddress": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Synapse/workspaces/firewallRules",
+      "apiVersion": "2021-06-01",
+      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+      "properties": {
+        "startIpAddress": "[parameters('startIpAddress')]",
+        "endIpAddress": "[parameters('endIpAddress')]"
+      }
+    }
+  ],
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the deployed firewall rule."
+      },
+      "value": "[parameters('name')]"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the deployed firewall rule."
+      },
+      "value": "[resourceId('Microsoft.Synapse/workspaces/firewallRules', parameters('workspaceName'), parameters('name'))]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group of the deployed firewall rule."
+      },
+      "value": "[resourceGroup().name]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/synapse/workspace/main.bicep b/avm/res/synapse/workspace/main.bicep
index d83c44ebbe..e396c1db28 100644
--- a/avm/res/synapse/workspace/main.bicep
+++ b/avm/res/synapse/workspace/main.bicep
@@ -66,6 +66,9 @@ param preventDataExfiltration bool = false
 @description('Optional. Enable or Disable public network access to workspace.')
 param publicNetworkAccess string = 'Enabled'
 
+@description('Optional. List of firewall rules to be created in the workspace.')
+param firewallRules firewallRuleType[]?
+
 @description('Optional. Purview Resource ID.')
 param purviewResourceID string = ''
 
@@ -329,8 +332,21 @@ resource workspace_roleAssignments 'Microsoft.Authorization/roleAssignments@2022
   }
 ]
 
+// Firewall Rules
+module workspace_firewallRules 'firewall-rules/main.bicep' = [
+  for (rule, index) in (firewallRules ?? []): {
+    name: '${uniqueString(deployment().name, location)}-workspace-FirewallRule-${index}'
+    params: {
+      name: rule.name
+      endIpAddress: rule.endIpAddress
+      startIpAddress: rule.startIpAddress
+      workspaceName: workspace.name
+    }
+  }
+]
+
 // Endpoints
-module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-workspace-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -371,8 +387,7 @@ module workspace_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -423,6 +438,17 @@ output systemAssignedMIPrincipalId string = workspace.?identity.?principalId ??
 @description('The location the resource was deployed into.')
 output location string = workspace.location
 
+@description('The private endpoints of the Synapse Workspace.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: workspace_privateEndpoints[i].outputs.name
+    resourceId: workspace_privateEndpoints[i].outputs.resourceId
+    groupId: workspace_privateEndpoints[i].outputs.groupId
+    customDnsConfig: workspace_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: workspace_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -482,11 +508,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
+
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
@@ -606,3 +641,14 @@ type adminType = {
   @secure()
   tenantId: string?
 }?
+
+type firewallRuleType = {
+  @description('Required. The name of the firewall rule.')
+  name: string
+
+  @description('Required. The start IP address of the firewall rule. Must be IPv4 format.')
+  startIpAddress: string
+
+  @description('Required. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress.')
+  endIpAddress: string
+}
diff --git a/avm/res/synapse/workspace/main.json b/avm/res/synapse/workspace/main.json
index 4ff8283f79..6b3b300ebf 100644
--- a/avm/res/synapse/workspace/main.json
+++ b/avm/res/synapse/workspace/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "16478885411774242991"
+      "templateHash": "2618570898047146464"
     },
     "name": "Synapse Workspaces",
     "description": "This module deploys a Synapse Workspace.",
@@ -164,21 +164,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -472,6 +495,29 @@
         }
       },
       "nullable": true
+    },
+    "firewallRuleType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The name of the firewall rule."
+          }
+        },
+        "startIpAddress": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The start IP address of the firewall rule. Must be IPv4 format."
+          }
+        },
+        "endIpAddress": {
+          "type": "string",
+          "metadata": {
+            "description": "Required. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress."
+          }
+        }
+      }
     }
   },
   "parameters": {
@@ -609,6 +655,16 @@
         "description": "Optional. Enable or Disable public network access to workspace."
       }
     },
+    "firewallRules": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/firewallRuleType"
+      },
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. List of firewall rules to be created in the workspace."
+      }
+    },
     "purviewResourceID": {
       "type": "string",
       "defaultValue": "",
@@ -1245,6 +1301,112 @@
         "workspace"
       ]
     },
+    "workspace_firewallRules": {
+      "copy": {
+        "name": "workspace_firewallRules",
+        "count": "[length(coalesce(parameters('firewallRules'), createArray()))]"
+      },
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-workspace-FirewallRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[coalesce(parameters('firewallRules'), createArray())[copyIndex()].name]"
+          },
+          "endIpAddress": {
+            "value": "[coalesce(parameters('firewallRules'), createArray())[copyIndex()].endIpAddress]"
+          },
+          "startIpAddress": {
+            "value": "[coalesce(parameters('firewallRules'), createArray())[copyIndex()].startIpAddress]"
+          },
+          "workspaceName": {
+            "value": "[parameters('name')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "6729418057172891787"
+            },
+            "name": "Synapse Workspaces Firewall Rules",
+            "description": "This module deploys Synapse Workspaces Firewall Rules.",
+            "owner": "Azure/module-maintainers"
+          },
+          "parameters": {
+            "workspaceName": {
+              "type": "string",
+              "metadata": {
+                "description": "Conditional. The name of the parent Synapse Workspace. Required if the template is used in a standalone deployment."
+              }
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the firewall rule."
+              }
+            },
+            "startIpAddress": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The start IP address of the firewall rule. Must be IPv4 format."
+              }
+            },
+            "endIpAddress": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Synapse/workspaces/firewallRules",
+              "apiVersion": "2021-06-01",
+              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+              "properties": {
+                "startIpAddress": "[parameters('startIpAddress')]",
+                "endIpAddress": "[parameters('endIpAddress')]"
+              }
+            }
+          ],
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the deployed firewall rule."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the deployed firewall rule."
+              },
+              "value": "[resourceId('Microsoft.Synapse/workspaces/firewallRules', parameters('workspaceName'), parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group of the deployed firewall rule."
+              },
+              "value": "[resourceGroup().name]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "workspace"
+      ]
+    },
     "workspace_privateEndpoints": {
       "copy": {
         "name": "workspace_privateEndpoints",
@@ -1277,11 +1439,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1310,13 +1469,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1568,6 +1748,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1603,18 +1806,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1695,7 +1891,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1774,7 +1970,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1785,28 +1981,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1814,12 +2034,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1833,27 +2056,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1920,6 +2152,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1977,6 +2216,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('workspace', '2021-06-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the Synapse Workspace."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('workspace_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/synapse/workspace/tests/e2e/fwrules/dependencies.bicep b/avm/res/synapse/workspace/tests/e2e/fwrules/dependencies.bicep
new file mode 100644
index 0000000000..11a476b1e7
--- /dev/null
+++ b/avm/res/synapse/workspace/tests/e2e/fwrules/dependencies.bicep
@@ -0,0 +1,31 @@
+@description('Optional. The location to deploy to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Storage Account to create.')
+param storageAccountName string
+
+resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
+  name: storageAccountName
+  location: location
+  sku: {
+    name: 'Standard_LRS'
+  }
+  kind: 'StorageV2'
+  properties: {
+    isHnsEnabled: true
+  }
+
+  resource blobService 'blobServices@2022-09-01' = {
+    name: 'default'
+
+    resource container 'containers@2022-09-01' = {
+      name: 'synapsews'
+    }
+  }
+}
+
+@description('The resource ID of the created Storage Account.')
+output storageAccountResourceId string = storageAccount.id
+
+@description('The name of the created container.')
+output storageContainerName string = storageAccount::blobService::container.name
diff --git a/avm/res/synapse/workspace/tests/e2e/fwrules/main.test.bicep b/avm/res/synapse/workspace/tests/e2e/fwrules/main.test.bicep
new file mode 100644
index 0000000000..4b5ea8d460
--- /dev/null
+++ b/avm/res/synapse/workspace/tests/e2e/fwrules/main.test.bicep
@@ -0,0 +1,72 @@
+targetScope = 'subscription'
+
+metadata name = 'Using firewall rules'
+metadata description = 'This instance deploys the module with the configuration of firewall rules.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'dep-${namePrefix}-synapse.workspaces-${serviceShort}-rg'
+
+@description('Optional. The location to deploy resources to.')
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'swfwr'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2022-09-01' = {
+  name: resourceGroupName
+  location: resourceLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
+  params: {
+    location: resourceLocation
+    storageAccountName: 'dep${namePrefix}sa${serviceShort}01'
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [
+  for iteration in ['init', 'idem']: {
+    scope: resourceGroup
+    name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
+    params: {
+      name: '${namePrefix}${serviceShort}001'
+      location: resourceLocation
+      defaultDataLakeStorageAccountResourceId: nestedDependencies.outputs.storageAccountResourceId
+      defaultDataLakeStorageFilesystem: nestedDependencies.outputs.storageContainerName
+      sqlAdministratorLogin: 'synwsadmin'
+      firewallRules: [
+        {
+          name: 'fwrule01'
+          endIpAddress: '87.14.134.20'
+          startIpAddress: '87.14.134.20'
+        }
+        {
+          name: 'fwrule02'
+          endIpAddress: '87.14.134.22'
+          startIpAddress: '87.14.134.21'
+        }
+      ]
+    }
+  }
+]
diff --git a/avm/res/synapse/workspace/tests/e2e/max/main.test.bicep b/avm/res/synapse/workspace/tests/e2e/max/main.test.bicep
index f01bd99d5f..f82dda192c 100644
--- a/avm/res/synapse/workspace/tests/e2e/max/main.test.bicep
+++ b/avm/res/synapse/workspace/tests/e2e/max/main.test.bicep
@@ -107,9 +107,13 @@ module testDeployment '../../../main.bicep' = [
       ]
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'SQL'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           tags: {
@@ -119,9 +123,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'SQL'
           subnetResourceId: nestedDependencies.outputs.customSubnet2ResourceId
           tags: {
@@ -131,9 +139,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'SqlOnDemand'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
           tags: {
@@ -143,9 +155,13 @@ module testDeployment '../../../main.bicep' = [
           }
         }
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'Dev'
           subnetResourceId: nestedDependencies.outputs.customSubnet1ResourceId
         }
diff --git a/avm/res/synapse/workspace/tests/e2e/waf-aligned/main.test.bicep b/avm/res/synapse/workspace/tests/e2e/waf-aligned/main.test.bicep
index d6a7bc47fb..fd330bd006 100644
--- a/avm/res/synapse/workspace/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/synapse/workspace/tests/e2e/waf-aligned/main.test.bicep
@@ -72,9 +72,13 @@ module testDeployment '../../../main.bicep' = [
       sqlAdministratorLogin: 'synwsadmin'
       privateEndpoints: [
         {
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           service: 'SQL'
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
           tags: {
diff --git a/avm/res/synapse/workspace/version.json b/avm/res/synapse/workspace/version.json
index e42c3d9e5f..7e1d3f4157 100644
--- a/avm/res/synapse/workspace/version.json
+++ b/avm/res/synapse/workspace/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.6",
+    "version": "0.7",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/web/hosting-environment/configuration--customdnssuffix/README.md b/avm/res/web/hosting-environment/configuration--customdnssuffix/README.md
index 0c37efe1cf..aa95a8c71f 100644
--- a/avm/res/web/hosting-environment/configuration--customdnssuffix/README.md
+++ b/avm/res/web/hosting-environment/configuration--customdnssuffix/README.md
@@ -7,7 +7,6 @@ This module deploys a Hosting Environment Custom DNS Suffix Configuration.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -66,10 +65,3 @@ The name of the parent Hosting Environment. Required if the template is used in
 | `name` | string | The name of the configuration. |
 | `resourceGroupName` | string | The resource group of the deployed configuration. |
 | `resourceId` | string | The resource ID of the deployed configuration. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/web/hosting-environment/configuration--networking/README.md b/avm/res/web/hosting-environment/configuration--networking/README.md
index 42a69da7ea..04c0307304 100644
--- a/avm/res/web/hosting-environment/configuration--networking/README.md
+++ b/avm/res/web/hosting-environment/configuration--networking/README.md
@@ -7,7 +7,6 @@ This module deploys a Hosting Environment Network Configuration.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -78,10 +77,3 @@ Property to enable and disable Remote Debug on ASEv3.
 | `name` | string | The name of the configuration. |
 | `resourceGroupName` | string | The resource group of the deployed configuration. |
 | `resourceId` | string | The resource ID of the deployed configuration. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/web/site/README.md b/avm/res/web/site/README.md
index 87bb14853a..5b72d460f5 100644
--- a/avm/res/web/site/README.md
+++ b/avm/res/web/site/README.md
@@ -24,6 +24,7 @@ This module deploys a Web or Function App.
 | `Microsoft.Web/sites` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/2022-09-01/sites) |
 | `Microsoft.Web/sites/basicPublishingCredentialsPolicies` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites) |
 | `Microsoft.Web/sites/config` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites) |
+| `Microsoft.Web/sites/extensions` | [2023-12-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites/extensions) |
 | `Microsoft.Web/sites/hybridConnectionNamespaces/relays` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/2022-09-01/sites/hybridConnectionNamespaces/relays) |
 | `Microsoft.Web/sites/slots` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/2022-09-01/sites/slots) |
 | `Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites) |
@@ -237,9 +238,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -248,9 +253,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -440,9 +449,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -451,9 +464,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -966,9 +983,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -977,9 +998,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -1190,9 +1215,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -1201,9 +1230,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -1474,9 +1507,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -1485,9 +1522,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -1695,9 +1736,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -1706,9 +1751,13 @@ module site 'br/public:avm/res/web/site:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -2068,7 +2117,9 @@ module site 'br/public:avm/res/web/site:<version>' = {
 | [`location`](#parameter-location) | string | Location for all Resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`logsConfiguration`](#parameter-logsconfiguration) | object | The logs settings configuration. |
+| [`managedEnvironmentId`](#parameter-managedenvironmentid) | string | Azure Resource Manager ID of the customers selected Managed Environment on which to host this app. |
 | [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. |
+| [`msDeployConfiguration`](#parameter-msdeployconfiguration) | object | The extension MSDeployment configuration. |
 | [`privateEndpoints`](#parameter-privateendpoints) | array | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. |
 | [`publicNetworkAccess`](#parameter-publicnetworkaccess) | string | Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set. |
 | [`redundancyMode`](#parameter-redundancymode) | string | Site redundancy mode. |
@@ -2102,6 +2153,7 @@ Type of site to deploy.
     'functionapp'
     'functionapp,linux'
     'functionapp,linux,container'
+    'functionapp,linux,container,azurecontainerapps'
     'functionapp,workflowapp'
     'functionapp,workflowapp,linux'
     'linux,api'
@@ -2474,6 +2526,13 @@ The logs settings configuration.
 - Required: No
 - Type: object
 
+### Parameter: `managedEnvironmentId`
+
+Azure Resource Manager ID of the customers selected Managed Environment on which to host this app.
+
+- Required: No
+- Type: string
+
 ### Parameter: `managedIdentities`
 
 The managed identity definition for this resource.
@@ -2502,6 +2561,13 @@ The resource ID(s) to assign to the resource.
 - Required: No
 - Type: array
 
+### Parameter: `msDeployConfiguration`
+
+The extension MSDeployment configuration.
+
+- Required: No
+- Type: object
+
 ### Parameter: `privateEndpoints`
 
 Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.
@@ -2529,8 +2595,7 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -2714,19 +2779,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The private DNS zone group to configure for the private endpoint.
 
 - Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private DNS zone group config.
 
 - Required: No
-- Type: array
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
+
+The name of the Private DNS Zone Group.
+
+- Required: No
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -3079,8 +3189,10 @@ Virtual Network Route All enabled. This causes all outbound traffic to have Virt
 | `defaultHostname` | string | Default hostname of the app. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the site. |
+| `privateEndpoints` | array | The private endpoints of the site. |
 | `resourceGroupName` | string | The resource group the site was deployed into. |
 | `resourceId` | string | The resource ID of the site. |
+| `slotPrivateEndpoints` | array | The private endpoints of the slots. |
 | `slotResourceIds` | array | The list of the slot resource ids. |
 | `slots` | array | The list of the slots. |
 | `slotSystemAssignedMIPrincipalIds` | array | The principal ID of the system assigned identity of slots. |
@@ -3092,7 +3204,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/web/site/config--appsettings/README.md b/avm/res/web/site/config--appsettings/README.md
index 38b40a2c43..17ff462236 100644
--- a/avm/res/web/site/config--appsettings/README.md
+++ b/avm/res/web/site/config--appsettings/README.md
@@ -7,7 +7,6 @@ This module deploys a Site App Setting.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 - [Notes](#Notes)
 
 ## Resource Types
@@ -56,6 +55,7 @@ Type of site to deploy.
     'functionapp'
     'functionapp,linux'
     'functionapp,linux,container'
+    'functionapp,linux,container,azurecontainerapps'
     'functionapp,workflowapp'
     'functionapp,workflowapp,linux'
     'linux,api'
@@ -106,13 +106,6 @@ If the provided storage account requires Identity based authentication ('allowSh
 | `resourceGroupName` | string | The resource group the site config was deployed into. |
 | `resourceId` | string | The resource ID of the site config. |
 
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
-
 ## Notes
 
 ### Parameter Usage: `appSettingsKeyValuePairs`
diff --git a/avm/res/web/site/config--appsettings/main.bicep b/avm/res/web/site/config--appsettings/main.bicep
index 2673285a59..2f770a7774 100644
--- a/avm/res/web/site/config--appsettings/main.bicep
+++ b/avm/res/web/site/config--appsettings/main.bicep
@@ -12,6 +12,7 @@ param appName string
   'functionapp,workflowapp' // logic app workflow
   'functionapp,workflowapp,linux' // logic app docker container
   'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
   'app,linux' // linux web app
   'app' // windows web app
   'linux,api' // linux api app
diff --git a/avm/res/web/site/config--appsettings/main.json b/avm/res/web/site/config--appsettings/main.json
index 3d310d7e2c..c59a554e2a 100644
--- a/avm/res/web/site/config--appsettings/main.json
+++ b/avm/res/web/site/config--appsettings/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "12675357375151621299"
+      "templateHash": "8777070640548664577"
     },
     "name": "Site App Settings",
     "description": "This module deploys a Site App Setting.",
@@ -27,6 +27,7 @@
         "functionapp,workflowapp",
         "functionapp,workflowapp,linux",
         "functionapp,linux,container",
+        "functionapp,linux,container,azurecontainerapps",
         "app,linux",
         "app",
         "linux,api",
diff --git a/avm/res/web/site/config--authsettingsv2/README.md b/avm/res/web/site/config--authsettingsv2/README.md
index 0e896309bf..b36b277e22 100644
--- a/avm/res/web/site/config--authsettingsv2/README.md
+++ b/avm/res/web/site/config--authsettingsv2/README.md
@@ -7,7 +7,6 @@ This module deploys a Site Auth Settings V2 Configuration.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -54,6 +53,7 @@ Type of site to deploy.
     'functionapp'
     'functionapp,linux'
     'functionapp,linux,container'
+    'functionapp,linux,container,azurecontainerapps'
     'functionapp,workflowapp'
     'functionapp,workflowapp,linux'
     'linux,api'
@@ -74,10 +74,3 @@ The name of the parent site resource. Required if the template is used in a stan
 | `name` | string | The name of the site config. |
 | `resourceGroupName` | string | The resource group the site config was deployed into. |
 | `resourceId` | string | The resource ID of the site config. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/web/site/config--authsettingsv2/main.bicep b/avm/res/web/site/config--authsettingsv2/main.bicep
index 3466c630fd..d5e2466c41 100644
--- a/avm/res/web/site/config--authsettingsv2/main.bicep
+++ b/avm/res/web/site/config--authsettingsv2/main.bicep
@@ -12,6 +12,7 @@ param appName string
   'functionapp,workflowapp' // logic app workflow
   'functionapp,workflowapp,linux' // logic app docker container
   'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
   'app,linux' // linux web app
   'app' // windows web app
   'linux,api' // linux api app
diff --git a/avm/res/web/site/config--authsettingsv2/main.json b/avm/res/web/site/config--authsettingsv2/main.json
index 597d41f573..88d23811d2 100644
--- a/avm/res/web/site/config--authsettingsv2/main.json
+++ b/avm/res/web/site/config--authsettingsv2/main.json
@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13561813663473459290"
+      "templateHash": "15126303852151434516"
     },
     "name": "Site Auth Settings V2 Config",
     "description": "This module deploys a Site Auth Settings V2 Configuration.",
@@ -26,6 +26,7 @@
         "functionapp,workflowapp",
         "functionapp,workflowapp,linux",
         "functionapp,linux,container",
+        "functionapp,linux,container,azurecontainerapps",
         "app,linux",
         "app",
         "linux,api",
diff --git a/avm/res/web/site/config--logs/README.md b/avm/res/web/site/config--logs/README.md
index 364b29196c..3bb077af5d 100644
--- a/avm/res/web/site/config--logs/README.md
+++ b/avm/res/web/site/config--logs/README.md
@@ -7,7 +7,6 @@ This module deploys a Site logs Configuration.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -45,10 +44,3 @@ The logs settings configuration.
 | `name` | string | The name of the site config. |
 | `resourceGroupName` | string | The resource group the site config was deployed into. |
 | `resourceId` | string | The resource ID of the site config. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/web/site/config--web/README.md b/avm/res/web/site/config--web/README.md
index 4385796b2a..ec967c3e6b 100644
--- a/avm/res/web/site/config--web/README.md
+++ b/avm/res/web/site/config--web/README.md
@@ -7,7 +7,6 @@ This module deploys a Site Api Management Configuration.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -45,10 +44,3 @@ The name of the parent site resource.
 | `name` | string | The name of the site config. |
 | `resourceGroupName` | string | The resource group the site config was deployed into. |
 | `resourceId` | string | The resource ID of the site config. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/web/site/extensions--msdeploy/README.md b/avm/res/web/site/extensions--msdeploy/README.md
new file mode 100644
index 0000000000..0def3b7ba3
--- /dev/null
+++ b/avm/res/web/site/extensions--msdeploy/README.md
@@ -0,0 +1,46 @@
+# Site Deployment Extension  `[Microsoft.Web/sites/extensions]`
+
+This module deploys a Site extension for MSDeploy.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Web/sites/extensions` | [2023-12-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites/extensions) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`appName`](#parameter-appname) | string | The name of the parent site resource. |
+| [`msDeployConfiguration`](#parameter-msdeployconfiguration) | object | Sets the MSDeployment Properties. |
+
+### Parameter: `appName`
+
+The name of the parent site resource.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `msDeployConfiguration`
+
+Sets the MSDeployment Properties.
+
+- Required: No
+- Type: object
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the MSDeploy Package. |
+| `resourceGroupName` | string | The resource group the site config was deployed into. |
+| `resourceId` | string | The resource ID of the Site Extension. |
diff --git a/avm/res/web/site/extensions--msdeploy/main.bicep b/avm/res/web/site/extensions--msdeploy/main.bicep
new file mode 100644
index 0000000000..07d8ef3405
--- /dev/null
+++ b/avm/res/web/site/extensions--msdeploy/main.bicep
@@ -0,0 +1,28 @@
+metadata name = 'Site Deployment Extension '
+metadata description = 'This module deploys a Site extension for MSDeploy.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Required. The name of the parent site resource.')
+param appName string
+
+@description('Required. Sets the MSDeployment Properties.')
+param msDeployConfiguration object?
+
+resource app 'Microsoft.Web/sites@2022-09-01' existing = {
+  name: appName
+}
+resource msdeploy 'Microsoft.Web/sites/extensions@2023-12-01' = {
+  name: 'MSDeploy'
+  kind: 'MSDeploy'
+  parent: app
+  properties: msDeployConfiguration
+}
+
+@description('The name of the MSDeploy Package.')
+output name string = msdeploy.name
+
+@description('The resource ID of the Site Extension.')
+output resourceId string = msdeploy.id
+
+@description('The resource group the site config was deployed into.')
+output resourceGroupName string = resourceGroup().name
diff --git a/avm/res/web/site/extensions--msdeploy/main.json b/avm/res/web/site/extensions--msdeploy/main.json
new file mode 100644
index 0000000000..fdc1b30f96
--- /dev/null
+++ b/avm/res/web/site/extensions--msdeploy/main.json
@@ -0,0 +1,71 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.29.47.4906",
+      "templateHash": "2006653133597094766"
+    },
+    "name": "Site Deployment Extension ",
+    "description": "This module deploys a Site extension for MSDeploy.",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "appName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The name of the parent site resource."
+      }
+    },
+    "msDeployConfiguration": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Required. Sets the MSDeployment Properties."
+      }
+    }
+  },
+  "resources": {
+    "app": {
+      "existing": true,
+      "type": "Microsoft.Web/sites",
+      "apiVersion": "2022-09-01",
+      "name": "[parameters('appName')]"
+    },
+    "msdeploy": {
+      "type": "Microsoft.Web/sites/extensions",
+      "apiVersion": "2023-12-01",
+      "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+      "kind": "MSDeploy",
+      "properties": "[parameters('msDeployConfiguration')]",
+      "dependsOn": [
+        "app"
+      ]
+    }
+  },
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the MSDeploy Package."
+      },
+      "value": "MSDeploy"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Site Extension."
+      },
+      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group the site config was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/web/site/main.bicep b/avm/res/web/site/main.bicep
index e970bbec86..1df6f94be1 100644
--- a/avm/res/web/site/main.bicep
+++ b/avm/res/web/site/main.bicep
@@ -15,6 +15,7 @@ param location string = resourceGroup().location
   'functionapp,workflowapp' // logic app workflow
   'functionapp,workflowapp,linux' // logic app docker container
   'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
   'app,linux' // linux web app
   'app' // windows web app
   'linux,api' // linux api app
@@ -27,6 +28,9 @@ param kind string
 @description('Required. The resource ID of the app service plan to use for the site.')
 param serverFarmResourceId string
 
+@description('Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app.')
+param managedEnvironmentId string?
+
 @description('Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests.')
 param httpsOnly bool = true
 
@@ -74,6 +78,9 @@ param storageAccountUseIdentityAuthentication bool = false
 @description('Optional. The web settings api management configuration.')
 param apiManagementConfiguration object?
 
+@description('Optional. The extension MSDeployment configuration.')
+param msDeployConfiguration object?
+
 @description('Optional. Resource ID of the app insight to leverage for this resource.')
 param appInsightResourceId string?
 
@@ -245,6 +252,7 @@ resource app 'Microsoft.Web/sites@2022-09-01' = {
   tags: tags
   identity: identity
   properties: {
+    managedEnvironmentId: !empty(managedEnvironmentId) ? managedEnvironmentId : null
     serverFarmId: serverFarmResourceId
     clientAffinityEnabled: clientAffinityEnabled
     httpsOnly: httpsOnly
@@ -317,6 +325,14 @@ module app_websettings 'config--web/main.bicep' = if (!empty(apiManagementConfig
   }
 }
 
+module extension_msdeploy 'extensions--msdeploy/main.bicep' = if (!empty(msDeployConfiguration)) {
+  name: '${uniqueString(deployment().name, location)}-Site-Extension-MSDeploy'
+  params: {
+    appName: app.name
+    msDeployConfiguration: msDeployConfiguration ?? {}
+  }
+}
+
 @batchSize(1)
 module app_slots 'slot/main.bicep' = [
   for (slot, index) in (slots ?? []): {
@@ -339,6 +355,7 @@ module app_slots 'slot/main.bicep' = [
       storageAccountUseIdentityAuthentication: slot.?storageAccountUseIdentityAuthentication ?? storageAccountUseIdentityAuthentication
       appInsightResourceId: slot.?appInsightResourceId ?? appInsightResourceId
       authSettingV2Configuration: slot.?authSettingV2Configuration ?? authSettingV2Configuration
+      msDeployConfiguration: slot.?msDeployConfiguration ?? msDeployConfiguration
       diagnosticSettings: slot.?diagnosticSettings
       roleAssignments: slot.?roleAssignments
       appSettingsKeyValuePairs: slot.?appSettingsKeyValuePairs ?? appSettingsKeyValuePairs
@@ -448,7 +465,7 @@ resource app_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01
   }
 ]
 
-module app_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module app_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-app-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -489,8 +506,7 @@ module app_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' =
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -533,6 +549,20 @@ output defaultHostname string = app.properties.defaultHostName
 @description('Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification.')
 output customDomainVerificationId string = app.properties.customDomainVerificationId
 
+@description('The private endpoints of the site.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: app_privateEndpoints[i].outputs.name
+    resourceId: app_privateEndpoints[i].outputs.resourceId
+    groupId: app_privateEndpoints[i].outputs.groupId
+    customDnsConfig: app_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: app_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
+@description('The private endpoints of the slots.')
+output slotPrivateEndpoints array = [for (slot, index) in (slots ?? []): app_slots[index].outputs.privateEndpoints]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -595,11 +625,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/web/site/main.json b/avm/res/web/site/main.json
index dc03e637a3..5d92e94f37 100644
--- a/avm/res/web/site/main.json
+++ b/avm/res/web/site/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "15924562884872907151"
+      "templateHash": "4298333170970358862"
     },
     "name": "Web/Function Apps",
     "description": "This module deploys a Web or Function App.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -474,6 +497,7 @@
         "functionapp,workflowapp",
         "functionapp,workflowapp,linux",
         "functionapp,linux,container",
+        "functionapp,linux,container,azurecontainerapps",
         "app,linux",
         "app",
         "linux,api",
@@ -491,6 +515,13 @@
         "description": "Required. The resource ID of the app service plan to use for the site."
       }
     },
+    "managedEnvironmentId": {
+      "type": "string",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+      }
+    },
     "httpsOnly": {
       "type": "bool",
       "defaultValue": true,
@@ -597,6 +628,13 @@
         "description": "Optional. The web settings api management configuration."
       }
     },
+    "msDeployConfiguration": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The extension MSDeployment configuration."
+      }
+    },
     "appInsightResourceId": {
       "type": "string",
       "nullable": true,
@@ -829,6 +867,7 @@
       "tags": "[parameters('tags')]",
       "identity": "[variables('identity')]",
       "properties": {
+        "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentId'))), parameters('managedEnvironmentId'), null())]",
         "serverFarmId": "[parameters('serverFarmResourceId')]",
         "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
         "httpsOnly": "[parameters('httpsOnly')]",
@@ -969,7 +1008,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "12675357375151621299"
+              "templateHash": "8777070640548664577"
             },
             "name": "Site App Settings",
             "description": "This module deploys a Site App Setting.",
@@ -990,6 +1029,7 @@
                 "functionapp,workflowapp",
                 "functionapp,workflowapp,linux",
                 "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
                 "app,linux",
                 "app",
                 "linux,api",
@@ -1125,7 +1165,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13561813663473459290"
+              "templateHash": "15126303852151434516"
             },
             "name": "Site Auth Settings V2 Config",
             "description": "This module deploys a Site Auth Settings V2 Configuration.",
@@ -1146,6 +1186,7 @@
                 "functionapp,workflowapp",
                 "functionapp,workflowapp,linux",
                 "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
                 "app,linux",
                 "app",
                 "linux,api",
@@ -1391,6 +1432,100 @@
         "app"
       ]
     },
+    "extension_msdeploy": {
+      "condition": "[not(empty(parameters('msDeployConfiguration')))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "appName": {
+            "value": "[parameters('name')]"
+          },
+          "msDeployConfiguration": {
+            "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "2006653133597094766"
+            },
+            "name": "Site Deployment Extension ",
+            "description": "This module deploys a Site extension for MSDeploy.",
+            "owner": "Azure/module-maintainers"
+          },
+          "parameters": {
+            "appName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the parent site resource."
+              }
+            },
+            "msDeployConfiguration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Required. Sets the MSDeployment Properties."
+              }
+            }
+          },
+          "resources": {
+            "app": {
+              "existing": true,
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2022-09-01",
+              "name": "[parameters('appName')]"
+            },
+            "msdeploy": {
+              "type": "Microsoft.Web/sites/extensions",
+              "apiVersion": "2023-12-01",
+              "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+              "kind": "MSDeploy",
+              "properties": "[parameters('msDeployConfiguration')]",
+              "dependsOn": [
+                "app"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the MSDeploy Package."
+              },
+              "value": "MSDeploy"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Site Extension."
+              },
+              "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the site config was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "app"
+      ]
+    },
     "app_slots": {
       "copy": {
         "name": "app_slots",
@@ -1458,6 +1593,9 @@
           "authSettingV2Configuration": {
             "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'authSettingV2Configuration'), parameters('authSettingV2Configuration'))]"
           },
+          "msDeployConfiguration": {
+            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'msDeployConfiguration'), parameters('msDeployConfiguration'))]"
+          },
           "diagnosticSettings": {
             "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
           },
@@ -1539,7 +1677,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "11317573376714089739"
+              "templateHash": "11723916533961427311"
             },
             "name": "Web/Function App Deployment Slots",
             "description": "This module deploys a Web or Function App Deployment Slot.",
@@ -1706,21 +1844,44 @@
                       "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
                     }
                   },
-                  "privateDnsZoneGroupName": {
-                    "type": "string",
-                    "nullable": true,
-                    "metadata": {
-                      "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-                    }
-                  },
-                  "privateDnsZoneResourceIds": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
+                  "privateDnsZoneGroup": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the Private DNS Zone Group."
+                        }
+                      },
+                      "privateDnsZoneGroupConfigs": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group config."
+                              }
+                            },
+                            "privateDnsZoneResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource id of the private DNS zone."
+                              }
+                            }
+                          }
+                        },
+                        "metadata": {
+                          "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                        }
+                      }
                     },
                     "nullable": true,
                     "metadata": {
-                      "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+                      "description": "Optional. The private DNS zone group to configure for the private endpoint."
                     }
                   },
                   "isManualConnection": {
@@ -2013,6 +2174,7 @@
                 "functionapp,workflowapp",
                 "functionapp,workflowapp,linux",
                 "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
                 "app,linux",
                 "app",
                 "linux,api",
@@ -2123,6 +2285,13 @@
                 "description": "Optional. The auth settings V2 configuration."
               }
             },
+            "msDeployConfiguration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. The extension MSDeployment configuration."
+              }
+            },
             "lock": {
               "$ref": "#/definitions/lockType",
               "metadata": {
@@ -2480,7 +2649,7 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "13666935650242306720"
+                      "templateHash": "7111332561212908044"
                     },
                     "name": "Site Slot App Settings",
                     "description": "This module deploys a Site Slot App Setting.",
@@ -2507,6 +2676,7 @@
                         "functionapp,workflowapp",
                         "functionapp,workflowapp,linux",
                         "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
                         "app,linux",
                         "app",
                         "linux,api",
@@ -2655,7 +2825,7 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "4716088455151443747"
+                      "templateHash": "3412962465179136371"
                     },
                     "name": "Site Slot Auth Settings V2 Config",
                     "description": "This module deploys a Site Auth Settings V2 Configuration.",
@@ -2682,6 +2852,7 @@
                         "functionapp,workflowapp",
                         "functionapp,workflowapp,linux",
                         "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
                         "app,linux",
                         "app",
                         "linux,api",
@@ -2982,6 +3153,100 @@
                 "slot"
               ]
             },
+            "slot_extensionMSdeploy": {
+              "condition": "[not(empty(parameters('msDeployConfiguration')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2022-09-01",
+              "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "appName": {
+                    "value": "[parameters('appName')]"
+                  },
+                  "msDeployConfiguration": {
+                    "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.29.47.4906",
+                      "templateHash": "2006653133597094766"
+                    },
+                    "name": "Site Deployment Extension ",
+                    "description": "This module deploys a Site extension for MSDeploy.",
+                    "owner": "Azure/module-maintainers"
+                  },
+                  "parameters": {
+                    "appName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the parent site resource."
+                      }
+                    },
+                    "msDeployConfiguration": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Required. Sets the MSDeployment Properties."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "app": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2022-09-01",
+                      "name": "[parameters('appName')]"
+                    },
+                    "msdeploy": {
+                      "type": "Microsoft.Web/sites/extensions",
+                      "apiVersion": "2023-12-01",
+                      "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+                      "kind": "MSDeploy",
+                      "properties": "[parameters('msDeployConfiguration')]",
+                      "dependsOn": [
+                        "app"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the MSDeploy Package."
+                      },
+                      "value": "MSDeploy"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Site Extension."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site config was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app"
+              ]
+            },
             "slot_privateEndpoints": {
               "copy": {
                 "name": "slot_privateEndpoints",
@@ -3014,11 +3279,8 @@
                   "lock": {
                     "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
                   },
-                  "privateDnsZoneGroupName": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-                  },
-                  "privateDnsZoneResourceIds": {
-                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+                  "privateDnsZoneGroup": {
+                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
                   },
                   "roleAssignments": {
                     "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -3047,13 +3309,34 @@
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "13720311665093076615"
+                      "templateHash": "1277254088602407590"
                     },
                     "name": "Private Endpoints",
                     "description": "This module deploys a Private Endpoint.",
                     "owner": "Azure/module-maintainers"
                   },
                   "definitions": {
+                    "privateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      }
+                    },
                     "roleAssignmentType": {
                       "type": "array",
                       "items": {
@@ -3305,6 +3588,29 @@
                         }
                       },
                       "nullable": true
+                    },
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
                     }
                   },
                   "parameters": {
@@ -3340,18 +3646,11 @@
                         "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
                       }
                     },
-                    "privateDnsZoneGroupName": {
-                      "type": "string",
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
                       "nullable": true,
                       "metadata": {
-                        "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-                      }
-                    },
-                    "privateDnsZoneResourceIds": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
                       }
                     },
                     "location": {
@@ -3432,7 +3731,7 @@
                       "condition": "[parameters('enableTelemetry')]",
                       "type": "Microsoft.Resources/deployments",
                       "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
                       "properties": {
                         "mode": "Incremental",
                         "template": {
@@ -3511,7 +3810,7 @@
                       ]
                     },
                     "privateEndpoint_privateDnsZoneGroup": {
-                      "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
                       "type": "Microsoft.Resources/deployments",
                       "apiVersion": "2022-09-01",
                       "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -3522,28 +3821,52 @@
                         "mode": "Incremental",
                         "parameters": {
                           "name": {
-                            "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                          },
-                          "privateDNSResourceIds": {
-                            "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                           },
                           "privateEndpointName": {
                             "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                           }
                         },
                         "template": {
                           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
                           "contentVersion": "1.0.0.0",
                           "metadata": {
                             "_generator": {
                               "name": "bicep",
                               "version": "0.29.47.4906",
-                              "templateHash": "15263454436186512874"
+                              "templateHash": "5805178546717255803"
                             },
                             "name": "Private Endpoint Private DNS Zone Groups",
                             "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                             "owner": "Azure/module-maintainers"
                           },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
                           "parameters": {
                             "privateEndpointName": {
                               "type": "string",
@@ -3551,12 +3874,15 @@
                                 "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                               }
                             },
-                            "privateDNSResourceIds": {
+                            "privateDnsZoneConfigs": {
                               "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
                               "minLength": 1,
                               "maxLength": 5,
                               "metadata": {
-                                "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                               }
                             },
                             "name": {
@@ -3570,27 +3896,36 @@
                           "variables": {
                             "copy": [
                               {
-                                "name": "privateDnsZoneConfigs",
-                                "count": "[length(parameters('privateDNSResourceIds'))]",
+                                "name": "privateDnsZoneConfigsVar",
+                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
                                 "input": {
-                                  "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                                   "properties": {
-                                    "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                                   }
                                 }
                               }
                             ]
                           },
-                          "resources": [
-                            {
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2023-11-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
                               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                               "apiVersion": "2023-11-01",
                               "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                               "properties": {
-                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                              }
+                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
                             }
-                          ],
+                          },
                           "outputs": {
                             "name": {
                               "type": "string",
@@ -3657,6 +3992,13 @@
                       },
                       "value": "[reference('privateEndpoint').customDnsConfigs]"
                     },
+                    "networkInterfaceIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The IDs of the network interfaces associated with the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').networkInterfaces]"
+                    },
                     "groupId": {
                       "type": "string",
                       "metadata": {
@@ -3708,6 +4050,22 @@
                 "description": "The location the resource was deployed into."
               },
               "value": "[reference('slot', '2022-09-01', 'full').location]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "metadata": {
+                "description": "The private endpoints of the slot."
+              },
+              "copy": {
+                "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+                "input": {
+                  "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                  "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                  "groupId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+                  "customDnsConfig": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+                  "networkInterfaceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+                }
+              }
             }
           }
         }
@@ -3971,11 +4329,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -4004,13 +4359,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -4262,6 +4638,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -4297,18 +4696,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -4389,7 +4781,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -4468,7 +4860,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -4479,28 +4871,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -4508,12 +4924,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -4527,27 +4946,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -4614,6 +5042,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -4708,6 +5143,32 @@
         "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
       },
       "value": "[reference('app').customDomainVerificationId]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the site."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
+    },
+    "slotPrivateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the slots."
+      },
+      "copy": {
+        "count": "[length(coalesce(parameters('slots'), createArray()))]",
+        "input": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]"
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/web/site/slot/README.md b/avm/res/web/site/slot/README.md
index 9ce9d0c594..063962c630 100644
--- a/avm/res/web/site/slot/README.md
+++ b/avm/res/web/site/slot/README.md
@@ -20,6 +20,7 @@ This module deploys a Web or Function App Deployment Slot.
 | `Microsoft.Insights/diagnosticSettings` | [2021-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2021-05-01-preview/diagnosticSettings) |
 | `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
 | `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Web/sites/extensions` | [2023-12-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites/extensions) |
 | `Microsoft.Web/sites/slots` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/2022-09-01/sites/slots) |
 | `Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites) |
 | `Microsoft.Web/sites/slots/config` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites) |
@@ -68,6 +69,7 @@ This module deploys a Web or Function App Deployment Slot.
 | [`location`](#parameter-location) | string | Location for all Resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. |
+| [`msDeployConfiguration`](#parameter-msdeployconfiguration) | object | The extension MSDeployment configuration. |
 | [`privateEndpoints`](#parameter-privateendpoints) | array | Configuration details for private endpoints. |
 | [`publicNetworkAccess`](#parameter-publicnetworkaccess) | string | Allow or block all public traffic. |
 | [`redundancyMode`](#parameter-redundancymode) | string | Site redundancy mode. |
@@ -100,6 +102,7 @@ Type of site to deploy.
     'functionapp'
     'functionapp,linux'
     'functionapp,linux,container'
+    'functionapp,linux,container,azurecontainerapps'
     'functionapp,workflowapp'
     'functionapp,workflowapp,linux'
     'linux,api'
@@ -493,6 +496,13 @@ The resource ID(s) to assign to the resource.
 - Required: No
 - Type: array
 
+### Parameter: `msDeployConfiguration`
+
+The extension MSDeployment configuration.
+
+- Required: No
+- Type: object
+
 ### Parameter: `privateEndpoints`
 
 Configuration details for private endpoints.
@@ -520,8 +530,7 @@ Configuration details for private endpoints.
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
 | [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
@@ -705,19 +714,64 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the private DNS zone group config.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the Private DNS Zone Group.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
@@ -1060,6 +1114,7 @@ Virtual Network Route All enabled. This causes all outbound traffic to have Virt
 | :-- | :-- | :-- |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the slot. |
+| `privateEndpoints` | array | The private endpoints of the slot. |
 | `resourceGroupName` | string | The resource group the slot was deployed into. |
 | `resourceId` | string | The resource ID of the slot. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1070,7 +1125,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Notes
 
diff --git a/avm/res/web/site/slot/config--appsettings/README.md b/avm/res/web/site/slot/config--appsettings/README.md
index 986f1f626e..6be3108fe1 100644
--- a/avm/res/web/site/slot/config--appsettings/README.md
+++ b/avm/res/web/site/slot/config--appsettings/README.md
@@ -7,7 +7,6 @@ This module deploys a Site Slot App Setting.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 - [Notes](#Notes)
 
 ## Resource Types
@@ -57,6 +56,7 @@ Type of site to deploy.
     'functionapp'
     'functionapp,linux'
     'functionapp,linux,container'
+    'functionapp,linux,container,azurecontainerapps'
     'functionapp,workflowapp'
     'functionapp,workflowapp,linux'
     'linux,api'
@@ -114,13 +114,6 @@ If the provided storage account requires Identity based authentication ('allowSh
 | `resourceGroupName` | string | The resource group the slot config was deployed into. |
 | `resourceId` | string | The resource ID of the slot config. |
 
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
-
 ## Notes
 
 ### Parameter Usage: `appSettingsKeyValuePairs`
diff --git a/avm/res/web/site/slot/config--appsettings/main.bicep b/avm/res/web/site/slot/config--appsettings/main.bicep
index 2717a81c3e..74095161a8 100644
--- a/avm/res/web/site/slot/config--appsettings/main.bicep
+++ b/avm/res/web/site/slot/config--appsettings/main.bicep
@@ -15,6 +15,7 @@ param appName string
   'functionapp,workflowapp' // logic app workflow
   'functionapp,workflowapp,linux' // logic app docker container
   'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
   'app,linux' // linux web app
   'app' // windows web app
   'linux,api' // linux api app
diff --git a/avm/res/web/site/slot/config--appsettings/main.json b/avm/res/web/site/slot/config--appsettings/main.json
index 63d016017d..48ed22304b 100644
--- a/avm/res/web/site/slot/config--appsettings/main.json
+++ b/avm/res/web/site/slot/config--appsettings/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13666935650242306720"
+      "templateHash": "7111332561212908044"
     },
     "name": "Site Slot App Settings",
     "description": "This module deploys a Site Slot App Setting.",
@@ -33,6 +33,7 @@
         "functionapp,workflowapp",
         "functionapp,workflowapp,linux",
         "functionapp,linux,container",
+        "functionapp,linux,container,azurecontainerapps",
         "app,linux",
         "app",
         "linux,api",
diff --git a/avm/res/web/site/slot/config--authsettingsv2/README.md b/avm/res/web/site/slot/config--authsettingsv2/README.md
index dd96430ae8..af8c04f6d3 100644
--- a/avm/res/web/site/slot/config--authsettingsv2/README.md
+++ b/avm/res/web/site/slot/config--authsettingsv2/README.md
@@ -7,7 +7,6 @@ This module deploys a Site Auth Settings V2 Configuration.
 - [Resource Types](#Resource-Types)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
-- [Cross-referenced modules](#Cross-referenced-modules)
 
 ## Resource Types
 
@@ -55,6 +54,7 @@ Type of site to deploy.
     'functionapp'
     'functionapp,linux'
     'functionapp,linux,container'
+    'functionapp,linux,container,azurecontainerapps'
     'functionapp,workflowapp'
     'functionapp,workflowapp,linux'
     'linux,api'
@@ -82,10 +82,3 @@ The name of the parent site resource. Required if the template is used in a stan
 | `name` | string | The name of the slot config. |
 | `resourceGroupName` | string | The resource group the slot config was deployed into. |
 | `resourceId` | string | The resource ID of the slot config. |
-
-## Cross-referenced modules
-
-This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
-
-| Reference | Type |
-| :-- | :-- |
diff --git a/avm/res/web/site/slot/config--authsettingsv2/main.bicep b/avm/res/web/site/slot/config--authsettingsv2/main.bicep
index 434eb52556..7b6b50f0a4 100644
--- a/avm/res/web/site/slot/config--authsettingsv2/main.bicep
+++ b/avm/res/web/site/slot/config--authsettingsv2/main.bicep
@@ -15,6 +15,7 @@ param slotName string
   'functionapp,workflowapp' // logic app workflow
   'functionapp,workflowapp,linux' // logic app docker container
   'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
   'app,linux' // linux web app
   'app' // windows web app
   'linux,api' // linux api app
diff --git a/avm/res/web/site/slot/config--authsettingsv2/main.json b/avm/res/web/site/slot/config--authsettingsv2/main.json
index d12274212c..489aa559b3 100644
--- a/avm/res/web/site/slot/config--authsettingsv2/main.json
+++ b/avm/res/web/site/slot/config--authsettingsv2/main.json
@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "4716088455151443747"
+      "templateHash": "3412962465179136371"
     },
     "name": "Site Slot Auth Settings V2 Config",
     "description": "This module deploys a Site Auth Settings V2 Configuration.",
@@ -32,6 +32,7 @@
         "functionapp,workflowapp",
         "functionapp,workflowapp,linux",
         "functionapp,linux,container",
+        "functionapp,linux,container,azurecontainerapps",
         "app,linux",
         "app",
         "linux,api",
diff --git a/avm/res/web/site/slot/extensions--msdeploy/README.md b/avm/res/web/site/slot/extensions--msdeploy/README.md
new file mode 100644
index 0000000000..cc50e99fbb
--- /dev/null
+++ b/avm/res/web/site/slot/extensions--msdeploy/README.md
@@ -0,0 +1,46 @@
+# Site Deployment Extension  `[Microsoft.Web/sites/slots/extensions]`
+
+This module deploys a Site extension for MSDeploy.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Web/sites/extensions` | [2023-12-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Web/sites/extensions) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`appName`](#parameter-appname) | string | The name of the parent site resource. |
+| [`msDeployConfiguration`](#parameter-msdeployconfiguration) | object | Sets the MSDeployment Properties. |
+
+### Parameter: `appName`
+
+The name of the parent site resource.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `msDeployConfiguration`
+
+Sets the MSDeployment Properties.
+
+- Required: No
+- Type: object
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the MSDeploy Package. |
+| `resourceGroupName` | string | The resource group the site config was deployed into. |
+| `resourceId` | string | The resource ID of the Site Extension. |
diff --git a/avm/res/web/site/slot/extensions--msdeploy/main.bicep b/avm/res/web/site/slot/extensions--msdeploy/main.bicep
new file mode 100644
index 0000000000..07d8ef3405
--- /dev/null
+++ b/avm/res/web/site/slot/extensions--msdeploy/main.bicep
@@ -0,0 +1,28 @@
+metadata name = 'Site Deployment Extension '
+metadata description = 'This module deploys a Site extension for MSDeploy.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Required. The name of the parent site resource.')
+param appName string
+
+@description('Required. Sets the MSDeployment Properties.')
+param msDeployConfiguration object?
+
+resource app 'Microsoft.Web/sites@2022-09-01' existing = {
+  name: appName
+}
+resource msdeploy 'Microsoft.Web/sites/extensions@2023-12-01' = {
+  name: 'MSDeploy'
+  kind: 'MSDeploy'
+  parent: app
+  properties: msDeployConfiguration
+}
+
+@description('The name of the MSDeploy Package.')
+output name string = msdeploy.name
+
+@description('The resource ID of the Site Extension.')
+output resourceId string = msdeploy.id
+
+@description('The resource group the site config was deployed into.')
+output resourceGroupName string = resourceGroup().name
diff --git a/avm/res/web/site/slot/extensions--msdeploy/main.json b/avm/res/web/site/slot/extensions--msdeploy/main.json
new file mode 100644
index 0000000000..fdc1b30f96
--- /dev/null
+++ b/avm/res/web/site/slot/extensions--msdeploy/main.json
@@ -0,0 +1,71 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.29.47.4906",
+      "templateHash": "2006653133597094766"
+    },
+    "name": "Site Deployment Extension ",
+    "description": "This module deploys a Site extension for MSDeploy.",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "appName": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. The name of the parent site resource."
+      }
+    },
+    "msDeployConfiguration": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Required. Sets the MSDeployment Properties."
+      }
+    }
+  },
+  "resources": {
+    "app": {
+      "existing": true,
+      "type": "Microsoft.Web/sites",
+      "apiVersion": "2022-09-01",
+      "name": "[parameters('appName')]"
+    },
+    "msdeploy": {
+      "type": "Microsoft.Web/sites/extensions",
+      "apiVersion": "2023-12-01",
+      "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+      "kind": "MSDeploy",
+      "properties": "[parameters('msDeployConfiguration')]",
+      "dependsOn": [
+        "app"
+      ]
+    }
+  },
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the MSDeploy Package."
+      },
+      "value": "MSDeploy"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the Site Extension."
+      },
+      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group the site config was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/web/site/slot/main.bicep b/avm/res/web/site/slot/main.bicep
index 7b0f107b73..1269d846dc 100644
--- a/avm/res/web/site/slot/main.bicep
+++ b/avm/res/web/site/slot/main.bicep
@@ -18,6 +18,7 @@ param location string = resourceGroup().location
   'functionapp,workflowapp' // logic app workflow
   'functionapp,workflowapp,linux' // logic app docker container
   'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
   'app,linux' // linux web app
   'app' // windows web app
   'linux,api' // linux api app
@@ -71,6 +72,9 @@ param appSettingsKeyValuePairs object?
 @description('Optional. The auth settings V2 configuration.')
 param authSettingV2Configuration object?
 
+@description('Optional. The extension MSDeployment configuration.')
+param msDeployConfiguration object?
+
 @description('Optional. The lock settings of the service.')
 param lock lockType
 
@@ -297,6 +301,14 @@ module slot_hybridConnectionRelays 'hybrid-connection-namespace/relay/main.bicep
   }
 ]
 
+module slot_extensionMSdeploy 'extensions--msdeploy/main.bicep' = if (!empty(msDeployConfiguration)) {
+  name: '${uniqueString(deployment().name, location)}-Site-Extension-MSDeploy'
+  params: {
+    appName: app.name
+    msDeployConfiguration: msDeployConfiguration ?? {}
+  }
+}
+
 resource slot_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
   name: lock.?name ?? 'lock-${name}'
   properties: {
@@ -353,7 +365,7 @@ resource slot_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-0
   }
 ]
 
-module slot_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module slot_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-slot-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -394,8 +406,7 @@ module slot_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1'
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -421,6 +432,17 @@ output systemAssignedMIPrincipalId string = slot.?identity.?principalId ?? ''
 @description('The location the resource was deployed into.')
 output location string = slot.location
 
+@description('The private endpoints of the slot.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: slot_privateEndpoints[i].outputs.name
+    resourceId: slot_privateEndpoints[i].outputs.resourceId
+    groupId: slot_privateEndpoints[i].outputs.groupId
+    customDnsConfig: slot_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: slot_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -483,11 +505,20 @@ type privateEndpointType = {
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/web/site/slot/main.json b/avm/res/web/site/slot/main.json
index 3d01db4de1..a81ad9d072 100644
--- a/avm/res/web/site/slot/main.json
+++ b/avm/res/web/site/slot/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "11317573376714089739"
+      "templateHash": "11723916533961427311"
     },
     "name": "Web/Function App Deployment Slots",
     "description": "This module deploys a Web or Function App Deployment Slot.",
@@ -173,21 +173,44 @@
               "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneGroupName": {
-            "type": "string",
-            "nullable": true,
-            "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-            }
-          },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -480,6 +503,7 @@
         "functionapp,workflowapp",
         "functionapp,workflowapp,linux",
         "functionapp,linux,container",
+        "functionapp,linux,container,azurecontainerapps",
         "app,linux",
         "app",
         "linux,api",
@@ -590,6 +614,13 @@
         "description": "Optional. The auth settings V2 configuration."
       }
     },
+    "msDeployConfiguration": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The extension MSDeployment configuration."
+      }
+    },
     "lock": {
       "$ref": "#/definitions/lockType",
       "metadata": {
@@ -947,7 +978,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13666935650242306720"
+              "templateHash": "7111332561212908044"
             },
             "name": "Site Slot App Settings",
             "description": "This module deploys a Site Slot App Setting.",
@@ -974,6 +1005,7 @@
                 "functionapp,workflowapp",
                 "functionapp,workflowapp,linux",
                 "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
                 "app,linux",
                 "app",
                 "linux,api",
@@ -1122,7 +1154,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "4716088455151443747"
+              "templateHash": "3412962465179136371"
             },
             "name": "Site Slot Auth Settings V2 Config",
             "description": "This module deploys a Site Auth Settings V2 Configuration.",
@@ -1149,6 +1181,7 @@
                 "functionapp,workflowapp",
                 "functionapp,workflowapp,linux",
                 "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
                 "app,linux",
                 "app",
                 "linux,api",
@@ -1449,6 +1482,100 @@
         "slot"
       ]
     },
+    "slot_extensionMSdeploy": {
+      "condition": "[not(empty(parameters('msDeployConfiguration')))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-Site-Extension-MSDeploy', uniqueString(deployment().name, parameters('location')))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "appName": {
+            "value": "[parameters('appName')]"
+          },
+          "msDeployConfiguration": {
+            "value": "[coalesce(parameters('msDeployConfiguration'), createObject())]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.29.47.4906",
+              "templateHash": "2006653133597094766"
+            },
+            "name": "Site Deployment Extension ",
+            "description": "This module deploys a Site extension for MSDeploy.",
+            "owner": "Azure/module-maintainers"
+          },
+          "parameters": {
+            "appName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the parent site resource."
+              }
+            },
+            "msDeployConfiguration": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Required. Sets the MSDeployment Properties."
+              }
+            }
+          },
+          "resources": {
+            "app": {
+              "existing": true,
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2022-09-01",
+              "name": "[parameters('appName')]"
+            },
+            "msdeploy": {
+              "type": "Microsoft.Web/sites/extensions",
+              "apiVersion": "2023-12-01",
+              "name": "[format('{0}/{1}', parameters('appName'), 'MSDeploy')]",
+              "kind": "MSDeploy",
+              "properties": "[parameters('msDeployConfiguration')]",
+              "dependsOn": [
+                "app"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the MSDeploy Package."
+              },
+              "value": "MSDeploy"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the Site Extension."
+              },
+              "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), 'MSDeploy')]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the site config was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "app"
+      ]
+    },
     "slot_privateEndpoints": {
       "copy": {
         "name": "slot_privateEndpoints",
@@ -1481,11 +1608,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1514,13 +1638,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1772,6 +1917,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1807,18 +1975,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1899,7 +2060,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1978,7 +2139,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1989,28 +2150,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -2018,12 +2203,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -2037,27 +2225,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -2124,6 +2321,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -2175,6 +2379,22 @@
         "description": "The location the resource was deployed into."
       },
       "value": "[reference('slot', '2022-09-01', 'full').location]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the slot."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/web/site/tests/e2e/functionApp.max/main.test.bicep b/avm/res/web/site/tests/e2e/functionApp.max/main.test.bicep
index 6e006101c9..a80f009727 100644
--- a/avm/res/web/site/tests/e2e/functionApp.max/main.test.bicep
+++ b/avm/res/web/site/tests/e2e/functionApp.max/main.test.bicep
@@ -174,9 +174,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -185,9 +189,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       roleAssignments: [
diff --git a/avm/res/web/site/tests/e2e/webApp.max/main.test.bicep b/avm/res/web/site/tests/e2e/webApp.max/main.test.bicep
index c11fda0625..bea7d0eeb1 100644
--- a/avm/res/web/site/tests/e2e/webApp.max/main.test.bicep
+++ b/avm/res/web/site/tests/e2e/webApp.max/main.test.bicep
@@ -184,9 +184,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -195,9 +199,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       roleAssignments: [
diff --git a/avm/res/web/site/tests/e2e/webAppLinux.max/main.test.bicep b/avm/res/web/site/tests/e2e/webAppLinux.max/main.test.bicep
index ab31f0adb6..9bc0ad9d8b 100644
--- a/avm/res/web/site/tests/e2e/webAppLinux.max/main.test.bicep
+++ b/avm/res/web/site/tests/e2e/webAppLinux.max/main.test.bicep
@@ -182,9 +182,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -193,9 +197,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       roleAssignments: [
diff --git a/avm/res/web/site/version.json b/avm/res/web/site/version.json
index 3f863a2bec..7e1d3f4157 100644
--- a/avm/res/web/site/version.json
+++ b/avm/res/web/site/version.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-    "version": "0.4",
+    "version": "0.7",
     "pathFilters": [
         "./main.json"
     ]
diff --git a/avm/res/web/static-site/README.md b/avm/res/web/static-site/README.md
index 51c97948d7..c0b10e3875 100644
--- a/avm/res/web/static-site/README.md
+++ b/avm/res/web/static-site/README.md
@@ -126,9 +126,13 @@ module staticSite 'br/public:avm/res/web/static-site:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -137,9 +141,13 @@ module staticSite 'br/public:avm/res/web/static-site:<version>' = {
         }
       }
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
       }
     ]
@@ -233,9 +241,13 @@ module staticSite 'br/public:avm/res/web/static-site:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -244,9 +256,13 @@ module staticSite 'br/public:avm/res/web/static-site:<version>' = {
           }
         },
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>"
         }
       ]
@@ -328,9 +344,13 @@ module staticSite 'br/public:avm/res/web/static-site:<version>' = {
     }
     privateEndpoints: [
       {
-        privateDnsZoneResourceIds: [
-          '<privateDNSZoneResourceId>'
-        ]
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            {
+              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
+            }
+          ]
+        }
         subnetResourceId: '<subnetResourceId>'
         tags: {
           Environment: 'Non-Prod'
@@ -402,9 +422,13 @@ module staticSite 'br/public:avm/res/web/static-site:<version>' = {
     "privateEndpoints": {
       "value": [
         {
-          "privateDnsZoneResourceIds": [
-            "<privateDNSZoneResourceId>"
-          ],
+          "privateDnsZoneGroup": {
+            "privateDnsZoneGroupConfigs": [
+              {
+                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
+              }
+            ]
+          },
           "subnetResourceId": "<subnetResourceId>",
           "tags": {
             "Environment": "Non-Prod",
@@ -653,8 +677,8 @@ Configuration details for private endpoints. For security reasons, it is recomme
 | [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
 | [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
 | [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
+| [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
 | [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
 | [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
 | [`service`](#parameter-privateendpointsservice) | string | The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory". |
@@ -837,19 +861,71 @@ The name of the private endpoint.
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.privateDnsZoneGroup`
+
+The private DNS zone group to configure for the private endpoint.
+
+- Required: No
+- Type: object
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the Private DNS Zone Group. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
+
+The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
+
+- Required: Yes
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`privateDnsZoneResourceId`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsprivatednszoneresourceid) | string | The resource id of the private DNS zone. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
+
+The resource id of the private DNS zone.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
+
+The name of the private DNS zone group config.
+
+- Required: No
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroup.name`
 
-The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.
+The name of the Private DNS Zone Group.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.privateLinkServiceConnectionName`
 
-The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+The name of the private link connection to create.
 
 - Required: No
-- Type: array
+- Type: string
 
 ### Parameter: `privateEndpoints.resourceGroupName`
 
@@ -1139,6 +1215,7 @@ Template Options for the static site.
 | `defaultHostname` | string | The default autogenerated hostname for the static site. |
 | `location` | string | The location the resource was deployed into. |
 | `name` | string | The name of the static site. |
+| `privateEndpoints` | array | The private endpoints of the static site. |
 | `resourceGroupName` | string | The resource group the static site was deployed into. |
 | `resourceId` | string | The resource ID of the static site. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
@@ -1149,7 +1226,7 @@ This section gives you an overview of all local-referenced module files (i.e., o
 
 | Reference | Type |
 | :-- | :-- |
-| `br/public:avm/res/network/private-endpoint:0.6.1` | Remote reference |
+| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
 
 ## Data Collection
 
diff --git a/avm/res/web/static-site/main.bicep b/avm/res/web/static-site/main.bicep
index aeaf56fe22..8676687f1a 100644
--- a/avm/res/web/static-site/main.bicep
+++ b/avm/res/web/static-site/main.bicep
@@ -241,7 +241,7 @@ resource staticSite_roleAssignments 'Microsoft.Authorization/roleAssignments@202
   }
 ]
 
-module staticSite_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.6.1' = [
+module staticSite_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-staticSite-PrivateEndpoint-${index}'
     scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
@@ -282,8 +282,7 @@ module staticSite_privateEndpoints 'br/public:avm/res/network/private-endpoint:0
         'Full'
       ).location
       lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
-      privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
+      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
       roleAssignments: privateEndpoint.?roleAssignments
       tags: privateEndpoint.?tags ?? tags
       customDnsConfigs: privateEndpoint.?customDnsConfigs
@@ -312,6 +311,17 @@ output location string = staticSite.location
 @description('The default autogenerated hostname for the static site.')
 output defaultHostname string = staticSite.properties.defaultHostname
 
+@description('The private endpoints of the static site.')
+output privateEndpoints array = [
+  for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
+    name: staticSite_privateEndpoints[i].outputs.name
+    resourceId: staticSite_privateEndpoints[i].outputs.resourceId
+    groupId: staticSite_privateEndpoints[i].outputs.groupId
+    customDnsConfig: staticSite_privateEndpoints[i].outputs.customDnsConfig
+    networkInterfaceIds: staticSite_privateEndpoints[i].outputs.networkInterfaceIds
+  }
+]
+
 // =============== //
 //   Definitions   //
 // =============== //
@@ -365,17 +375,29 @@ type privateEndpointType = {
   @description('Optional. The location to deploy the private endpoint to.')
   location: string?
 
+  @description('Optional. The name of the private link connection to create.')
+  privateLinkServiceConnectionName: string?
+
   @description('Optional. The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory".')
   service: string?
 
   @description('Required. Resource ID of the subnet where the endpoint needs to be created.')
   subnetResourceId: string
 
-  @description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
-  privateDnsZoneGroupName: string?
+  @description('Optional. The private DNS zone group to configure for the private endpoint.')
+  privateDnsZoneGroup: {
+    @description('Optional. The name of the Private DNS Zone Group.')
+    name: string?
+
+    @description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
+    privateDnsZoneGroupConfigs: {
+      @description('Optional. The name of the private DNS zone group config.')
+      name: string?
 
-  @description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
-  privateDnsZoneResourceIds: string[]?
+      @description('Required. The resource id of the private DNS zone.')
+      privateDnsZoneResourceId: string
+    }[]
+  }?
 
   @description('Optional. If Manual Private Link Connection is required.')
   isManualConnection: bool?
diff --git a/avm/res/web/static-site/main.json b/avm/res/web/static-site/main.json
index 7317946c9c..81746c626a 100644
--- a/avm/res/web/static-site/main.json
+++ b/avm/res/web/static-site/main.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.29.47.4906",
-      "templateHash": "13375787239295645610"
+      "templateHash": "15796777918776565235"
     },
     "name": "Static Web Apps",
     "description": "This module deploys a Static Web App.",
@@ -153,34 +153,64 @@
               "description": "Optional. The location to deploy the private endpoint to."
             }
           },
-          "service": {
+          "privateLinkServiceConnectionName": {
             "type": "string",
             "nullable": true,
             "metadata": {
-              "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
+              "description": "Optional. The name of the private link connection to create."
             }
           },
-          "subnetResourceId": {
+          "service": {
             "type": "string",
+            "nullable": true,
             "metadata": {
-              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+              "description": "Optional. The subresource to deploy the private endpoint for. For example \"vault\", \"mysqlServer\" or \"dataFactory\"."
             }
           },
-          "privateDnsZoneGroupName": {
+          "subnetResourceId": {
             "type": "string",
-            "nullable": true,
             "metadata": {
-              "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
+              "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
             }
           },
-          "privateDnsZoneResourceIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
+          "privateDnsZoneGroup": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "nullable": true,
+                "metadata": {
+                  "description": "Optional. The name of the Private DNS Zone Group."
+                }
+              },
+              "privateDnsZoneGroupConfigs": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the private DNS zone group config."
+                      }
+                    },
+                    "privateDnsZoneResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource id of the private DNS zone."
+                      }
+                    }
+                  }
+                },
+                "metadata": {
+                  "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                }
+              }
             },
             "nullable": true,
             "metadata": {
-              "description": "Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones."
+              "description": "Optional. The private DNS zone group to configure for the private endpoint."
             }
           },
           "isManualConnection": {
@@ -1009,11 +1039,8 @@
           "lock": {
             "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
           },
-          "privateDnsZoneGroupName": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroupName')]"
-          },
-          "privateDnsZoneResourceIds": {
-            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneResourceIds')]"
+          "privateDnsZoneGroup": {
+            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
           },
           "roleAssignments": {
             "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
@@ -1042,13 +1069,34 @@
             "_generator": {
               "name": "bicep",
               "version": "0.29.47.4906",
-              "templateHash": "13720311665093076615"
+              "templateHash": "1277254088602407590"
             },
             "name": "Private Endpoints",
             "description": "This module deploys a Private Endpoint.",
             "owner": "Azure/module-maintainers"
           },
           "definitions": {
+            "privateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                  }
+                }
+              }
+            },
             "roleAssignmentType": {
               "type": "array",
               "items": {
@@ -1300,6 +1348,29 @@
                 }
               },
               "nullable": true
+            },
+            "privateDnsZoneGroupConfigType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private DNS zone group config."
+                  }
+                },
+                "privateDnsZoneResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The resource id of the private DNS zone."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                }
+              }
             }
           },
           "parameters": {
@@ -1335,18 +1406,11 @@
                 "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
               }
             },
-            "privateDnsZoneGroupName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided."
-              }
-            },
-            "privateDnsZoneResourceIds": {
-              "type": "array",
+            "privateDnsZoneGroup": {
+              "$ref": "#/definitions/privateDnsZoneGroupType",
               "nullable": true,
               "metadata": {
-                "description": "Optional. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                "description": "Optional. The private DNS zone group to configure for the private endpoint."
               }
             },
             "location": {
@@ -1427,7 +1491,7 @@
               "condition": "[parameters('enableTelemetry')]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2024-03-01",
-              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.6.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
               "properties": {
                 "mode": "Incremental",
                 "template": {
@@ -1506,7 +1570,7 @@
               ]
             },
             "privateEndpoint_privateDnsZoneGroup": {
-              "condition": "[not(empty(parameters('privateDnsZoneResourceIds')))]",
+              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2022-09-01",
               "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
@@ -1517,28 +1581,52 @@
                 "mode": "Incremental",
                 "parameters": {
                   "name": {
-                    "value": "[coalesce(parameters('privateDnsZoneGroupName'), 'default')]"
-                  },
-                  "privateDNSResourceIds": {
-                    "value": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())]"
+                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                   },
                   "privateEndpointName": {
                     "value": "[parameters('name')]"
+                  },
+                  "privateDnsZoneConfigs": {
+                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                   }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
                       "version": "0.29.47.4906",
-                      "templateHash": "15263454436186512874"
+                      "templateHash": "5805178546717255803"
                     },
                     "name": "Private Endpoint Private DNS Zone Groups",
                     "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                     "owner": "Azure/module-maintainers"
                   },
+                  "definitions": {
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    }
+                  },
                   "parameters": {
                     "privateEndpointName": {
                       "type": "string",
@@ -1546,12 +1634,15 @@
                         "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                       }
                     },
-                    "privateDNSResourceIds": {
+                    "privateDnsZoneConfigs": {
                       "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                      },
                       "minLength": 1,
                       "maxLength": 5,
                       "metadata": {
-                        "description": "Required. Array of private DNS zone resource IDs. A DNS zone group can support up to 5 DNS zones."
+                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                       }
                     },
                     "name": {
@@ -1565,27 +1656,36 @@
                   "variables": {
                     "copy": [
                       {
-                        "name": "privateDnsZoneConfigs",
-                        "count": "[length(parameters('privateDNSResourceIds'))]",
+                        "name": "privateDnsZoneConfigsVar",
+                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
                         "input": {
-                          "name": "[last(split(parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')], '/'))]",
+                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                           "properties": {
-                            "privateDnsZoneId": "[parameters('privateDNSResourceIds')[copyIndex('privateDnsZoneConfigs')]]"
+                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                           }
                         }
                       }
                     ]
                   },
-                  "resources": [
-                    {
+                  "resources": {
+                    "privateEndpoint": {
+                      "existing": true,
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2023-11-01",
+                      "name": "[parameters('privateEndpointName')]"
+                    },
+                    "privateDnsZoneGroup": {
                       "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                       "apiVersion": "2023-11-01",
                       "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                       "properties": {
-                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigs')]"
-                      }
+                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
                     }
-                  ],
+                  },
                   "outputs": {
                     "name": {
                       "type": "string",
@@ -1652,6 +1752,13 @@
               },
               "value": "[reference('privateEndpoint').customDnsConfigs]"
             },
+            "networkInterfaceIds": {
+              "type": "array",
+              "metadata": {
+                "description": "The IDs of the network interfaces associated with the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').networkInterfaces]"
+            },
             "groupId": {
               "type": "string",
               "metadata": {
@@ -1709,6 +1816,22 @@
         "description": "The default autogenerated hostname for the static site."
       },
       "value": "[reference('staticSite').defaultHostname]"
+    },
+    "privateEndpoints": {
+      "type": "array",
+      "metadata": {
+        "description": "The private endpoints of the static site."
+      },
+      "copy": {
+        "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
+        "input": {
+          "name": "[reference(format('staticSite_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+          "resourceId": "[reference(format('staticSite_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+          "groupId": "[reference(format('staticSite_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
+          "customDnsConfig": "[reference(format('staticSite_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
+          "networkInterfaceIds": "[reference(format('staticSite_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
+        }
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/avm/res/web/static-site/tests/e2e/max/main.test.bicep b/avm/res/web/static-site/tests/e2e/max/main.test.bicep
index 0e3371b513..a9ab63a678 100644
--- a/avm/res/web/static-site/tests/e2e/max/main.test.bicep
+++ b/avm/res/web/static-site/tests/e2e/max/main.test.bicep
@@ -64,9 +64,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
@@ -75,9 +79,13 @@ module testDeployment '../../../main.bicep' = [
         }
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
         }
       ]
       roleAssignments: [
diff --git a/avm/res/web/static-site/tests/e2e/waf-aligned/main.test.bicep b/avm/res/web/static-site/tests/e2e/waf-aligned/main.test.bicep
index 77c04b71b2..ac51dd33e6 100644
--- a/avm/res/web/static-site/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/web/static-site/tests/e2e/waf-aligned/main.test.bicep
@@ -63,9 +63,13 @@ module testDeployment '../../../main.bicep' = [
       privateEndpoints: [
         {
           subnetResourceId: nestedDependencies.outputs.subnetResourceId
-          privateDnsZoneResourceIds: [
-            nestedDependencies.outputs.privateDNSZoneResourceId
-          ]
+          privateDnsZoneGroup: {
+            privateDnsZoneGroupConfigs: [
+              {
+                privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
+              }
+            ]
+          }
           tags: {
             'hidden-title': 'This is visible in the resource name'
             Environment: 'Non-Prod'
diff --git a/avm/res/web/static-site/version.json b/avm/res/web/static-site/version.json
index 13669e6601..ea4f3b6e67 100644
--- a/avm/res/web/static-site/version.json
+++ b/avm/res/web/static-site/version.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.4",
+  "version": "0.5",
   "pathFilters": [
     "./main.json"
   ]
diff --git a/avm/utilities/pipelines/e2eValidation/resourceRemoval/Initialize-DeploymentRemoval.ps1 b/avm/utilities/pipelines/e2eValidation/resourceRemoval/Initialize-DeploymentRemoval.ps1
index bcaa55703a..32ef457548 100644
--- a/avm/utilities/pipelines/e2eValidation/resourceRemoval/Initialize-DeploymentRemoval.ps1
+++ b/avm/utilities/pipelines/e2eValidation/resourceRemoval/Initialize-DeploymentRemoval.ps1
@@ -72,6 +72,7 @@ function Initialize-DeploymentRemoval {
         # The initial sequence is a general order-recommendation
         $RemoveFirstSequence = @(
             'Microsoft.Authorization/locks',
+            'Microsoft.VirtualMachineImages/imageTemplates', # Must be removed before their MSI & should be removed before its entities permissions are removed
             'Microsoft.Authorization/roleAssignments',
             'Microsoft.Insights/diagnosticSettings',
             'Microsoft.Network/privateEndpoints/privateDnsZoneGroups',
@@ -91,7 +92,6 @@ function Initialize-DeploymentRemoval {
             'Microsoft.MachineLearningServices/workspaces',
             'Microsoft.Compute/virtualMachines',
             'Microsoft.ContainerInstance/containerGroups' # Must be removed before their MSI
-            'Microsoft.VirtualMachineImages/imageTemplates', # Must be removed before their MSI
             'Microsoft.ManagedIdentity/userAssignedIdentities',
             'Microsoft.Databricks/workspaces'
             'Microsoft.Resources/resourceGroups'
diff --git a/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Get-DeploymentTargetResourceList.ps1 b/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Get-DeploymentTargetResourceList.ps1
index 61f5a6e1fb..3338aef342 100644
--- a/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Get-DeploymentTargetResourceList.ps1
+++ b/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Get-DeploymentTargetResourceList.ps1
@@ -1,4 +1,109 @@
-#region helper
+#region helper
+<#
+.SYNOPSIS
+Get all deployment operations at a given scope
+
+.DESCRIPTION
+Get all deployment oeprations at a given scope. By default, the results are filtered down to 'create' operations (i.e., excluding 'read' operations that would correspond to 'existing' resources).
+
+.PARAMETER Name
+Mandatory. The deployment name to search for
+
+.PARAMETER ResourceGroupName
+Optional. The name of the resource group for scope 'resourcegroup'. Relevant for resource-group-level deployments.
+
+.PARAMETER SubscriptionId
+Optional. The ID of the subscription to fetch deployments from. Relevant for subscription- & resource-group-level deployments.
+
+.PARAMETER ManagementGroupId
+Optional. The ID of the management group to fetch deployments from. Relevant for management-group-level deployments.
+
+.PARAMETER Scope
+Mandatory. The scope to search in
+
+.PARAMETER ProvisioningOperationsToInclude
+Optional. The provisioning operations to include in the result set. By default, only 'create' operations are included.
+
+.EXAMPLE
+Get-DeploymentOperationAtScope -Scope 'subscription' -Name 'v73rhp24d7jya-test-apvmiaiboaai'
+
+Get all deployment operations for a deployment with name 'v73rhp24d7jya-test-apvmiaiboaai' at scope 'subscription'
+
+.NOTES
+This function is a standin for the Get-AzDeploymentOperation cmdlet, which does not provide the ability to filter by provisioning operation.
+As such, it was also returning 'existing' resources (i.e., with provisioningOperation=Read).
+#>
+function Get-DeploymentOperationAtScope {
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory)]
+        [Alias('DeploymentName')]
+        [string] $Name,
+
+        [Parameter(Mandatory = $false)]
+        [string] $ResourceGroupName,
+
+        [Parameter(Mandatory = $false)]
+        [string] $SubscriptionId,
+
+        [Parameter(Mandatory = $false)]
+        [string] $ManagementGroupId,
+
+        [Parameter(Mandatory = $false)]
+        [ValidateSet(
+            'Create', # any resource creation
+            'Read', # E.g., 'existing' resources
+            'EvaluateDeploymentOutput' # Nobody knows
+        )]
+        [string[]] $ProvisioningOperationsToInclude = @('Create'),
+
+        [Parameter(Mandatory)]
+        [ValidateSet(
+            'resourcegroup',
+            'subscription',
+            'managementgroup',
+            'tenant'
+        )]
+        [string] $Scope
+    )
+
+
+    switch ($Scope) {
+        'resourcegroup' {
+            $path = '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Resources/deployments/{2}/operations?api-version=2021-04-01' -f $SubscriptionId, $ResourceGroupName, $name
+            break
+        }
+        'subscription' {
+            $path = '/subscriptions/{0}/providers/Microsoft.Resources/deployments/{1}/operations?api-version=2021-04-01' -f $SubscriptionId, $name
+            break
+        }
+        'managementgroup' {
+            $path = '/providers/Microsoft.Management/managementGroups/{0}/providers/Microsoft.Resources/deployments/{1}/operations?api-version=2021-04-01' -f $ManagementGroupId, $name
+            break
+        }
+        'tenant' {
+            $path = '/providers/Microsoft.Resources/deployments/{0}/operations?api-version=2021-04-01' -f $name
+            break
+        }
+    }
+
+    ##############################################
+    # Get all deployment children based on scope #
+    ##############################################
+
+    $response = Invoke-AzRestMethod -Method 'GET' -Path $path
+
+    if ($response.StatusCode -ne 200) {
+        Write-Error ('Failed to fetch deployment operations for deployment [{0}] in scope [{1}]' -f $name, $scope)
+        return
+    } else {
+        $deploymentOperations = ($response.content | ConvertFrom-Json).value.properties
+        $deploymentOperationsFiltered = $deploymentOperations | Where-Object { $_.provisioningOperation -in $ProvisioningOperationsToInclude }
+        return $deploymentOperationsFiltered ?? $true # Returning true to indicate that the deployment was found, but did not contain any relevant operations
+    }
+}
+
 <#
 .SYNOPSIS
 Get all deployments that match a given deployment name in a given scope
@@ -18,6 +123,9 @@ Optional. The ID of the management group to fetch deployments from. Relevant for
 .PARAMETER Scope
 Mandatory. The scope to search in
 
+.PARAMETER DoThrow
+Optional. Throw an exception if a deployment cannot be found. If not set, a warning is returned instead.
+
 .EXAMPLE
 Get-DeploymentTargetResourceListInner -Name 'keyvault-12356' -Scope 'resourcegroup'
 
@@ -54,7 +162,10 @@ function Get-DeploymentTargetResourceListInner {
             'managementgroup',
             'tenant'
         )]
-        [string] $Scope
+        [string] $Scope,
+
+        [Parameter(Mandatory = $false)]
+        [switch] $DoThrow
     )
 
     $resultSet = [System.Collections.ArrayList]@()
@@ -63,13 +174,23 @@ function Get-DeploymentTargetResourceListInner {
     ##############################################
     # Get all deployment children based on scope #
     ##############################################
+    $baseInputObject = @{
+        Scope          = $Scope
+        DeploymentName = $Name
+    }
     switch ($Scope) {
         'resourcegroup' {
             if (Get-AzResourceGroup -Name $resourceGroupName -ErrorAction 'SilentlyContinue') {
-                if ($op = Get-AzResourceGroupDeploymentOperation -DeploymentName $name -ResourceGroupName $resourceGroupName) {
-                    [array]$deploymentTargets = $op.TargetResource | Where-Object { $_ -ne $null } | Select-Object -Unique
+                if ($op = Get-DeploymentOperationAtScope @baseInputObject -ResourceGroupName $resourceGroupName -SubscriptionId $currentContext.Subscription.Id) {
+                    [array]$deploymentTargets = $op.TargetResource.id | Where-Object { $_ -ne $null } | Select-Object -Unique
                 } else {
-                    throw 'NoDeploymentFound'
+                    $message = "Not found deployment [$Name] in scope [$Scope] of Resource Group [$ResourceGroupName]."
+                    if ($DoThrow) {
+                        throw $message
+                    } else {
+                        Write-Warning "$message Ignoring, as nested deployment."
+                        return
+                    }
                 }
             } else {
                 # In case the resource group itself was already deleted, there is no need to try and fetch deployments from it
@@ -79,24 +200,44 @@ function Get-DeploymentTargetResourceListInner {
             break
         }
         'subscription' {
-            if ($op = Get-AzDeploymentOperation -DeploymentName $name) {
-                [array]$deploymentTargets = $op.TargetResource | Where-Object { $_ -ne $null } | Select-Object -Unique
+            if ($op = Get-DeploymentOperationAtScope @baseInputObject -SubscriptionId $currentContext.Subscription.Id) {
+                [array]$deploymentTargets = $op.TargetResource.id | Where-Object { $_ -ne $null } | Select-Object -Unique
             } else {
-                throw 'NoDeploymentFound'
+                $message = "Not found deployment [$Name] in scope [$Scope]."
+                if ($DoThrow) {
+                    throw $message
+                } else {
+                    Write-Warning "$message Ignoring, as nested deployment."
+                    return
+                }
             }
             break
         }
         'managementgroup' {
-            if ($op = Get-AzManagementGroupDeploymentOperation -DeploymentName $name -ManagementGroupId $ManagementGroupId) {
-                [array]$deploymentTargets = $op.TargetResource | Where-Object { $_ -ne $null } | Select-Object -Unique
+            if ($op = Get-DeploymentOperationAtScope @baseInputObject -ManagementGroupId $ManagementGroupId) {
+                [array]$deploymentTargets = $op.TargetResource.id | Where-Object { $_ -ne $null } | Select-Object -Unique
+            } else {
+                $message = "Not found deployment [$Name] in scope [$Scope]."
+                if ($DoThrow) {
+                    throw $message
+                } else {
+                    Write-Warning "$message Ignoring, as nested deployment."
+                    return
+                }
             }
-            throw 'NoDeploymentFound'
+            break
         }
         'tenant' {
-            if ($op = Get-AzTenantDeploymentOperation -DeploymentName $name) {
-                [array]$deploymentTargets = $op.TargetResource | Where-Object { $_ -ne $null } | Select-Object -Unique
+            if ($op = Get-DeploymentOperationAtScope @baseInputObject) {
+                [array]$deploymentTargets = $op.TargetResource.id | Where-Object { $_ -ne $null } | Select-Object -Unique
             } else {
-                throw 'NoDeploymentFound'
+                $message = "Not found deployment [$Name] in scope [$Scope]."
+                if ($DoThrow) {
+                    throw $message
+                } else {
+                    Write-Warning "$message Ignoring, as nested deployment."
+                    return
+                }
             }
             break
         }
@@ -105,7 +246,7 @@ function Get-DeploymentTargetResourceListInner {
     ###########################
     # Manage nested resources #
     ###########################
-    foreach ($deployment in ($deploymentTargets | Where-Object { $_ -notmatch '\/deployments\/' } )) {
+    foreach ($deployment in ($deploymentTargets | Where-Object { $_ -notmatch '\/Microsoft\.Resources\/deployments\/' } )) {
         Write-Verbose ('Found deployed resource [{0}]' -f $deployment)
         [array]$resultSet += $deployment
     }
@@ -113,7 +254,7 @@ function Get-DeploymentTargetResourceListInner {
     #############################
     # Manage nested deployments #
     #############################
-    foreach ($deployment in ($deploymentTargets | Where-Object { $_ -match '\/deployments\/' } )) {
+    foreach ($deployment in ($deploymentTargets | Where-Object { $_ -match '\/Microsoft\.Resources\/deployments\/' } )) {
         $name = Split-Path $deployment -Leaf
         if ($deployment -match '/resourceGroups/') {
             # Resource Group Level Child Deployments #
@@ -250,7 +391,7 @@ function Get-DeploymentTargetResourceList {
                 $innerInputObject['ManagementGroupId'] = $ManagementGroupId
             }
             try {
-                $targetResources = Get-DeploymentTargetResourceListInner @innerInputObject
+                $targetResources = Get-DeploymentTargetResourceListInner @innerInputObject -DoThrow # Specifying [-DoThrow] for top-level deployments that we definitely want to resolve
                 Write-Verbose ('Found & resolved deployment [{0}]. [{1}] resources found to remove.' -f $deploymentNameObject.Name, $targetResources.Count) -Verbose
                 $deploymentNameObject.Resolved = $true
                 $resourcesToRemove += $targetResources
@@ -271,7 +412,7 @@ function Get-DeploymentTargetResourceList {
     if ($searchRetryCount -gt $searchRetryLimit) {
         $remainingDeploymentNames = ($deploymentNameObjects | Where-Object { -not $_.Resolved }).Name
 
-        # We don't want to outright throw an exception as we want to remove as many resources as possible before failing the script in the calling functino
+        # We don't want to outright throw an exception as we want to remove as many resources as possible before failing the script in the calling function
         return @{
             resolveError      = ('No deployment for the deployment name(s) [{0}] found' -f ($remainingDeploymentNames -join ', '))
             resourcesToRemove = $resourcesToRemove
diff --git a/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Invoke-ResourcePostRemoval.ps1 b/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Invoke-ResourcePostRemoval.ps1
index d78e5860cd..4e13284417 100644
--- a/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Invoke-ResourcePostRemoval.ps1
+++ b/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Invoke-ResourcePostRemoval.ps1
@@ -33,7 +33,7 @@ function Invoke-ResourcePostRemoval {
         [int] $PostRemovalRetryLimit = 3
     )
 
-    $postRemovalRetryCount = 1
+    $removalRetryCount = 1
     do {
         try {
             switch ($Type) {
@@ -191,5 +191,5 @@ function Invoke-ResourcePostRemoval {
             Write-Warning ('[!] Post-removal operation failed. Reason: [{0}]. Retry [{1}/{2}]' -f $_.Exception.Message, $removalRetryCount, $PostRemovalRetryLimit)
             $removalRetryCount++
         }
-    } while ($postRemovalRetryCount -le $PostRemovalRetryLimit)
+    } while ($removalRetryCount -le $PostRemovalRetryLimit)
 }
diff --git a/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Remove-ResourceList.ps1 b/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Remove-ResourceList.ps1
index da37cb679d..1f6e3ba055 100644
--- a/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Remove-ResourceList.ps1
+++ b/avm/utilities/pipelines/e2eValidation/resourceRemoval/helper/Remove-ResourceList.ps1
@@ -36,7 +36,7 @@ function Remove-ResourceListInner {
 
         foreach ($resource in $resourcesToRemove) {
             $resourceName = Split-Path $resource.resourceId -Leaf
-            $alreadyProcessed = $processedResources.count -gt 0 ? (($processedResources | Where-Object { $resource.resourceId -like ('{0}*' -f $_) }).Count -gt 0) : $false
+            $alreadyProcessed = $processedResources.count -gt 0 ? (($processedResources | Where-Object { $resource.resourceId -like ('{0}/*' -f $_) }).Count -gt 0) : $false
 
             if ($alreadyProcessed) {
                 # Skipping
diff --git a/avm/utilities/pipelines/platform/Set-AvmGitHubPrLabels.ps1 b/avm/utilities/pipelines/platform/Set-AvmGitHubPrLabels.ps1
new file mode 100644
index 0000000000..a22fabe460
--- /dev/null
+++ b/avm/utilities/pipelines/platform/Set-AvmGitHubPrLabels.ps1
@@ -0,0 +1,75 @@
+<#
+.SYNOPSIS
+Checks new PRs and adds labels, depending if module owner can approve, or core team is needed
+
+.DESCRIPTION
+For the given PR, the "needs core team" label will be added, if the module is orphaned or the sole module owner is creating the PR
+
+.PARAMETER Repo
+Mandatory. The name of the respository to scan. Needs to have the structure "<owner>/<repositioryName>", like 'Azure/bicep-registry-modules/'
+
+.PARAMETER RepoRoot
+Optional. Path to the root of the repository.
+
+.PARAMETER PrUrl
+Mandatory. The URL of the GitHub pull request, like 'https://github.com/Azure/bicep-registry-modules/pull/2540'
+
+.EXAMPLE
+Set-AvmGitHubPrLabels -Repo 'Azure/bicep-registry-modules' -PrUrl 'https://github.com/Azure/bicep-registry-modules/pull/2540'
+
+.NOTES
+Will be triggered by the corresponding platform workflow
+#>
+function Set-AvmGitHubPrLabels {
+    param (
+        [Parameter(Mandatory = $true)]
+        [string] $Repo,
+
+        [Parameter(Mandatory = $true)]
+        [string] $PrUrl,
+
+        [Parameter(Mandatory = $false)]
+        [string] $RepoRoot = (Get-Item -Path $PSScriptRoot).parent.parent.parent.parent.FullName
+    )
+
+    # Loading helper functions
+    . (Join-Path $RepoRoot 'avm' 'utilities' 'pipelines' 'platform' 'helper' 'Get-GithubPrRequestedReviewerTeamNames.ps1')
+    . (Join-Path $RepoRoot 'avm' 'utilities' 'pipelines' 'platform' 'helper' 'Get-GithubTeamMembersLogin.ps1')
+    . (Join-Path $RepoRoot 'avm' 'utilities' 'pipelines' 'platform' 'helper' 'Get-AvmCsvData.ps1')
+
+    $sanitizedPrUrl = $PrUrl.Replace('api.', '').Replace('repos/', '').Replace('pulls/', 'pull/')
+    $pr = gh pr view $sanitizedPrUrl --json 'author,title,url,body,comments' --repo $Repo | ConvertFrom-Json -Depth 100
+    $allTeamNames = [array](Get-GithubPrRequestedReviewerTeamNames -PrUrl $pr.url)
+    $teamNames = [array]($allTeamNames | Where-Object { $_ -ne 'bicep-admins' -and $_ -ne 'avm-core-team-technical-bicep' -and $_ -ne 'avm-module-reviewers-bicep' })
+
+    if ($allTeamNames.Count -gt 0) {
+        # core team is already assigned, no or more than one module reviewer team is assigned
+        if ($allTeamNames.Contains('avm-core-team-technical-bicep') -or $teamNames.Count -eq 0 -or $teamNames.Count -gt 1) {
+            gh pr edit $pr.url --add-label 'Needs: Core Team :genie:' --repo $Repo
+        } else {
+            $teamMembers = [array](Get-GithubTeamMembersLogin -OrgName $Repo.Split('/')[0] -TeamName $teamNames[0])
+
+            # no members in module team or only one and that user submitted the PR
+            if (($teamMembers.Count -eq 0) -or ($teamMembers.Count -eq 1 -and $teamMembers[0] -eq $pr.author.login)) {
+                gh pr edit $pr.url --add-label 'Needs: Core Team :genie:' --repo $Repo
+            } else {
+                gh pr edit $pr.url --add-label 'Needs: Module Owner :mega:' --repo $Repo
+            }
+
+            # check for orphanded module
+            $moduleName = $teamNames[0]
+            $moduleIndex = $moduleName.StartsWith('avm-res') ? 'Bicep-Resource' : ($moduleName.StartsWith('avm-ptn') ? 'Bicep-Pattern' : 'Bicep-Utility')
+            # get CSV data
+            $modules = Get-AvmCsvData -ModuleIndex $moduleIndex
+
+            foreach ($module in $modules) {
+                if ($module.ModuleName.Replace('-', '').Replace('/', '-') -eq $moduleName) {
+                    if ($module.ModuleStatus -eq 'Orphaned :eyes:') {
+                        gh pr edit $pr.url --add-label 'Status: Module Orphaned :eyes:' --repo $Repo
+                        break;
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/avm/utilities/pipelines/platform/deploymentRemoval/Clear-ManagementGroupDeploymentHistory.ps1 b/avm/utilities/pipelines/platform/deploymentRemoval/Clear-ManagementGroupDeploymentHistory.ps1
index 85c347420f..9bbf51e1a0 100644
--- a/avm/utilities/pipelines/platform/deploymentRemoval/Clear-ManagementGroupDeploymentHistory.ps1
+++ b/avm/utilities/pipelines/platform/deploymentRemoval/Clear-ManagementGroupDeploymentHistory.ps1
@@ -53,7 +53,12 @@ function Clear-ManagementGroupDeploymentHistory {
             Authorization = 'Bearer {0}' -f ((Get-AzAccessToken -AsSecureString).Token | ConvertFrom-SecureString -AsPlainText)
         }
     }
-    $response = Invoke-RestMethod @getInputObject
+    try {
+        $response = Invoke-RestMethod @getInputObject
+    } catch {
+        Write-Warning "Management Group [$ManagementGroupId] not found or not authorized. Skipping removal."
+        return
+    }
 
     if (($response | Get-Member -MemberType 'NoteProperty').Name -notcontains 'value') {
         throw ('Fetching deployments failed with error [{0}]' -f ($reponse | Out-String))
diff --git a/avm/utilities/pipelines/platform/helper/Get-GithubPrRequestedReviewerTeamNames.ps1 b/avm/utilities/pipelines/platform/helper/Get-GithubPrRequestedReviewerTeamNames.ps1
new file mode 100644
index 0000000000..c97927ad60
--- /dev/null
+++ b/avm/utilities/pipelines/platform/helper/Get-GithubPrRequestedReviewerTeamNames.ps1
@@ -0,0 +1,27 @@
+<#
+.SYNOPSIS
+Gets all requested reviewer names that are teams (not individual users) for a given GitHub pull request
+
+.DESCRIPTION
+Gets all requested reviewer names that are teams (not individual users) for a given GitHub pull request
+
+.PARAMETER PrUrl
+Mandatory. The GitHub pull request URL (for example https://github.com/Azure/bicep-registry-modules/pull/2540)
+
+.EXAMPLE
+Get-GithubPrRequestedReviewerTeamNames -PrUrl 'https://github.com/Azure/bicep-registry-modules/pull/2540'
+
+.NOTES
+Needs to run under a context with the permissions to read pull requests
+#>
+function Get-GithubPrRequestedReviewerTeamNames {
+    param (
+        [Parameter(Mandatory = $true)]
+        [string] $PrUrl
+    )
+
+    $modifiedPrUrl = ($PrUrl.Replace('https://github.com', '/repos').Replace('/pull', '/pulls') + '/requested_reviewers')
+    $reviewers = (gh api -H 'Accept: application/vnd.github+json' -H 'X-GitHub-Api-Version: 2022-11-28' $modifiedPrUrl) | ConvertFrom-Json -Depth 100
+
+    return $reviewers.teams | Select-Object -ExpandProperty name
+}
diff --git a/avm/utilities/pipelines/platform/helper/Get-GithubTeamMembersLogin.ps1 b/avm/utilities/pipelines/platform/helper/Get-GithubTeamMembersLogin.ps1
new file mode 100644
index 0000000000..5ab8c52e85
--- /dev/null
+++ b/avm/utilities/pipelines/platform/helper/Get-GithubTeamMembersLogin.ps1
@@ -0,0 +1,32 @@
+<#
+.SYNOPSIS
+Gets the login name of all team members for a given GitHub team
+
+.DESCRIPTION
+Gets the login name of all team members for a given GitHub team
+
+.PARAMETER OrgName
+Mandatory. The name of the GitHub organization
+
+.PARAMETER TeamName
+Mandatory. The name of the GitHub team (from that organization)
+
+.EXAMPLE
+Get-GithubTeamMembersLogin -OrgName 'Azure' -TeamName 'avm-core-team-technical-bicep'
+
+.NOTES
+Needs to run under a context with the permissions to read organisations directory
+#>
+function Get-GithubTeamMembersLogin {
+    param (
+        [Parameter(Mandatory = $true)]
+        [string] $OrgName,
+
+        [Parameter(Mandatory = $true)]
+        [string] $TeamName
+    )
+
+    $teamMembers = (gh api -H 'Accept: application/vnd.github+json' -H 'X-GitHub-Api-Version: 2022-11-28' /orgs/$OrgName/teams/$TeamName/members) | ConvertFrom-Json -Depth 100
+
+    return $teamMembers | Select-Object -ExpandProperty login
+}
diff --git a/avm/utilities/pipelines/sharedScripts/Set-ModuleReadMe.ps1 b/avm/utilities/pipelines/sharedScripts/Set-ModuleReadMe.ps1
index 00fda4f5fe..3669c1f75a 100644
--- a/avm/utilities/pipelines/sharedScripts/Set-ModuleReadMe.ps1
+++ b/avm/utilities/pipelines/sharedScripts/Set-ModuleReadMe.ps1
@@ -776,7 +776,7 @@ function Set-CrossReferencesSection {
 
     $dependencies = $CrossReferencedModuleList[$FullModuleIdentifier]
 
-    if ($dependencies -and -not $dependencies['localPathReferences'] -and -not $dependencies['remoteReferences']) {
+    if (-not $dependencies -or ($dependencies -and -not $dependencies['localPathReferences'] -and -not $dependencies['remoteReferences'])) {
         # no cross references in the template
         return $ReadMeFileContent
     }
@@ -1117,23 +1117,24 @@ function ConvertTo-FormattedJSONParameterObject {
         $line = $pattern.replace($line, '"$1":', 1)
 
         # [2.5] Syntax: Replace Bicep resource ID references
-        $mayHaveValue = $line -match '\s*.+:\s+'
+        $mayHaveValue = $line -match '^\s*.+?:\s+'
         if ($mayHaveValue) {
 
-            $lineValue = ($line -split '\s*.+:\s+')[1].Trim() # i.e. optional spaces, followed by a name ("xzy"), followed by ':', folowed by at least a space
+            $lineValue = ($line -split '^\s*.+?:\s+')[1].Trim() # i.e., optional spaces, followed by a name ("xzy"), followed by ':', folowed by at least a space
 
             # Individual checks
-            $isLineWithEmptyObjectValue = $line -match '^.+:\s*{\s*}\s*$' # e.g. test: {}
-            $isLineWithObjectPropertyReferenceValue = $lineValue -like '*.*' # e.g. resourceGroupResources.outputs.virtualWWANResourceId`
+            $isLineWithEmptyObjectValue = $line -match '^.+:\s*{\s*}\s*$' # e.g., test: {}
+            $isLineWithObjectPropertyReferenceValue = $lineValue -match '(?<=[^"])\b\.\b(?=[^"]*$)' # e.g., resourceGroupResources.outputs.virtualWWANResourceId, but not "domainName": "onmicrosoft.com"
             $isLineWithReferenceInLineKey = ($line -split ':')[0].Trim() -like '*.*'
-
-            $isLineWithStringValue = $lineValue -match '".+"' # e.g. "value"
-            $isLineWithStringNestedFunction = $lineValue -match "^['|`"]{1}.*\$\{.+['|`"]{1}$|^['|`"]{0}[a-zA-Z\(]+\(.+" # e.g. (split(resourceGroupResources.outputs.recoveryServicesVaultResourceId, "/"))[4] or '${last(...)}' or last() or "test${environment()}"
+            $isLineWithStringNestedReference = $lineValue -match "['|`"]{1}.*\$\{.+" # e.g., "Download ${initializeSoftwareScriptName}"  or '${last(...)}'
+            $isLineWithStringValue = $lineValue -match '^".+"$' # e.g. "value"
+            $isLineWithFunction = $lineValue -match '^[a-zA-Z]+\(.+' # e.g., split(something)
             $isLineWithPlainValue = $lineValue -match '^\w+$' # e.g. adminPassword: password
-            $isLineWithPrimitiveValue = $lineValue -match '^\s*true|false|[0-9]+$' # e.g. isSecure: true
+            $isLineWithPrimitiveValue = $lineValue -match '^\s*true|false|[0-9]+$' # e.g., isSecure: true
+            $isLineContainingCondition = $lineValue -match '^\w+ [=!?|&]{2} .+\?.+\:.+$' # e.g., iteration == "init" ? "A" : "B"
 
             # Special case: Multi-line function
-            $isLineWithMultilineFunction = $lineValue -match '[a-zA-Z]+\s*\([^\)]*\){0}\s*$' # e.g. roleDefinitionIdOrName: subscriptionResourceId( \n 'Microsoft.Authorization/roleDefinitions', \n 'acdd72a7-3385-48ef-bd42-f606fba81ae7' \n )
+            $isLineWithMultilineFunction = $lineValue -match '[a-zA-Z]+\s*\([^\)]*\){0}\s*$' # e.g., roleDefinitionIdOrName: subscriptionResourceId( \n 'Microsoft.Authorization/roleDefinitions', \n 'acdd72a7-3385-48ef-bd42-f606fba81ae7' \n )
             if ($isLineWithMultilineFunction) {
                 # Search leading indent so that we can use it to identify at which line the function ends
                 $indent = ([regex]::Match($paramInJSONFormatArray[$index], '^(\s+)')).Captures.Groups[1].Value.Length
@@ -1171,7 +1172,7 @@ function ConvertTo-FormattedJSONParameterObject {
                 $isLineWithObjectReferenceKeyAndEmptyObjectValue = $isLineWithEmptyObjectValue -and $isLineWithReferenceInLineKey
                 # In case of any contained function like '"backupVaultResourceGroup": (split(resourceGroupResources.outputs.recoveryServicesVaultResourceId, "/"))[4]' we'll only show "<backupVaultResourceGroup>"
 
-                if ($isLineWithObjectPropertyReference -or $isLineWithStringNestedFunction -or $isLineWithParameterOrVariableReferenceValue) {
+                if ($isLineWithObjectPropertyReference -or $isLineWithStringNestedReference -or $isLineWithFunction -or $isLineWithParameterOrVariableReferenceValue -or $isLineContainingCondition) {
                     $line = '{0}: "<{1}>"' -f ($line -split ':')[0], ([regex]::Match(($line -split ':')[0], '"(.+)"')).Captures.Groups[1].Value
                 } elseif ($isLineWithObjectReferenceKeyAndEmptyObjectValue) {
                     $line = '"<{0}>": {1}' -f (($line -split ':')[0] -split '\.')[-1].TrimEnd('}"'), $lineValue
@@ -1184,6 +1185,9 @@ function ConvertTo-FormattedJSONParameterObject {
             } elseif ($line -match '^\s*[a-zA-Z]+\s*$') {
                 # If there is simply only a value such as a variable reference, we'll wrap it as a string to replace. For example a reference of a variable `addressPrefix` will be replaced with `"<addressPrefix>"`
                 $line = '"<{0}>"' -f $line.Trim()
+            } elseif ($line -match "['|`"]{1}.*\$\{.+") {
+                # If the line contains a string with a reference, we're replacing the reference with a placeholder. For example "pwsh \"${initializeSoftwareScriptName}\"" would only show "pwsh <value>"
+                $line = $line -replace '\$\{.+\}', '<value>'
             }
         }
 
@@ -1195,13 +1199,26 @@ function ConvertTo-FormattedJSONParameterObject {
 
     # [2.7] Syntax: Add comma everywhere unless:
     # - the current line has an opening 'object: {' or 'array: [' character
-    # - the line after the current line has a closing 'object: {' or 'array: [' character
+    # - the line after the current line has a closing 'object: }' or 'array: ]' character
     # - it's the last closing bracket
+    # - is a comment
     for ($index = 0; $index -lt $paramInJSONFormatArray.Count; $index++) {
-        if (($paramInJSONFormatArray[$index] -match '[\{|\[]\s*$') -or (($index -lt $paramInJSONFormatArray.Count - 1) -and $paramInJSONFormatArray[$index + 1] -match '^\s*[\]|\}]\s*$') -or ($index -eq $paramInJSONFormatArray.Count - 1)) {
+        $isOpeningObjectOrArray = $paramInJSONFormatArray[$index] -match '[\{|\[]\s*$'
+        $nextLineIsClosingObjectOrArray = ($index -lt $paramInJSONFormatArray.Count - 1) -and $paramInJSONFormatArray[$index + 1] -match '^\s*[\]|\}]\s*$'
+        $isLastLine = $index -eq $paramInJSONFormatArray.Count - 1
+        $isComment = $paramInJSONFormatArray[$index] -match '^\s*\/\/.*'
+        if ($isOpeningObjectOrArray -or $nextLineIsClosingObjectOrArray -or $isLastLine -or $isComment) {
             continue
         }
-        $paramInJSONFormatArray[$index] = '{0},' -f $paramInJSONFormatArray[$index].Trim()
+
+        if ( $paramInJSONFormatArray[$index] -match '(?<![:\/])\/\/.*$' ) {
+            # Has inline comment (i.e., a situation where you have '//' not enclosed by quotes)
+            $lineElements = $paramInJSONFormatArray[$index] -split '(?<![:\/])\/\/.*$'
+            $paramInJSONFormatArray[$index] = '{0}, // {1}' -f $lineElements[0].Trim(), $lineElements[1].Trim()
+
+        } else {
+            $paramInJSONFormatArray[$index] = '{0},' -f $paramInJSONFormatArray[$index].Trim()
+        }
     }
 
     # [2.8] Format the final JSON string to an object to enable processing
diff --git a/avm/utilities/pipelines/sharedScripts/helper/Get-CrossReferencedModuleList.ps1 b/avm/utilities/pipelines/sharedScripts/helper/Get-CrossReferencedModuleList.ps1
index 55c5c87d90..ec32409602 100644
--- a/avm/utilities/pipelines/sharedScripts/helper/Get-CrossReferencedModuleList.ps1
+++ b/avm/utilities/pipelines/sharedScripts/helper/Get-CrossReferencedModuleList.ps1
@@ -91,8 +91,8 @@ function Get-ReferenceObject {
     foreach ($involvedFilePath in (@($ModuleTemplateFilePath) + @($involvedFilePaths))) {
         $moduleContent = $TemplateMap[$involvedFilePath]
 
-        $resultSet.resourceReferences += @() + $moduleContent | Where-Object { $_ -match "^resource .+ '(.+)' .+$" } | ForEach-Object { $matches[1] }
-        $resultSet.remoteReferences += @() + $moduleContent | Where-Object { $_ -match "^module .+ '(.+:.+)' .+$" } | ForEach-Object { $matches[1] }
+        $resultSet.resourceReferences += @() + $moduleContent | Where-Object { $_ -match "^resource .+ '(.+?)' .+$" } | ForEach-Object { $matches[1] }
+        $resultSet.remoteReferences += @() + $moduleContent | Where-Object { $_ -match "^module .+ '(.+:.+?)' .+$" } | ForEach-Object { $matches[1] }
     }
 
     return @{
@@ -110,7 +110,7 @@ Get a list of all resource/module references in a given module path
 .DESCRIPTION
 As an output you will receive a hashtable that (for each provider namespace) lists the
 - Directly deployed resources (e.g. via "resource myDeployment 'Microsoft.(..)/(..)@(..)'")
-- Linked remote module tempaltes (e.g. via "module rg 'br/modules:(..):(..)'")
+- Linked remote module templates (e.g. via "module rg 'br/modules:(..):(..)'")
 
 .PARAMETER Path
 Optional. The path to search in. Defaults to the 'res' folder.
diff --git a/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml b/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml
index ac04f433c9..55cf9edc75 100644
--- a/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml
+++ b/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml
@@ -16,7 +16,7 @@ binding:
 # Require minimum versions of modules.
 requires:
   PSRule: "@pre >=2.9.0"
-  PSRule.Rules.Azure: "@pre >=1.29.0"
+  PSRule.Rules.Azure: "@pre >=1.38.0"
 
 # Use PSRule for Azure.
 include:
@@ -81,3 +81,4 @@ rule:
     - Azure.VM.UseHybridUseBenefit
     - Azure.AppConfig.PurgeProtect
     - Azure.MySQL.MaintenanceWindow # Must be excluded until https://msdata.visualstudio.com/Database%20Systems/_workitems/edit/2788114 is fixed
+    - Azure.AppService.AvailabilityZone # Must disable as the serverfarm premium skus are not available in the AVM subscription. The module is WAF-aligned, just the tests don't validate it